CVE-2008-2267
Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to...
- Published
- May 16, 2008
- Updated
- Aug 7, 2024
- Assigning CNA
- mitre
- Evidence observed
- May 12, 2008
Primary CVSS
nvd · CVSS 2.0
AV:N/AC:L/Au:N/C:P/I:P/A:PLow · next 30 days
- Percentile
- 91.8%
- Model date
- Oct 11, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by uploading a file with a name ending in (1) .jsp, (2) .php3, (3) .cgi, (4) .dhtml, (5) .phtml, (6) .php5, or (7) .jar, then accessing it via a direct request to the file in modules/FileManager/postlet/.
Sources
EgiX · php · May 12, 2008
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.