CVEvulnerability
CVE-2010-5091
6.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-08-26
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-94
Description
The setName function in filesystem/File.php in SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with CMS author privileges to execute arbitrary PHP code by changing the extension of an uploaded file.
Affected configurations
• silverstripe silverstripe 2.3.0
• silverstripe silverstripe 2.3.1
• silverstripe silverstripe 2.3.2
• silverstripe silverstripe 2.3.3
• silverstripe silverstripe 2.3.4
• silverstripe silverstripe 2.3.5
• silverstripe silverstripe 2.3.6
• silverstripe silverstripe 2.3.7
• silverstripe silverstripe 2.4.0
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- http://dl.packetstormsecurity.net/1006-exploits/silverstripe-shell.txt Exploit
- http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.8 doc.silverstripe.org
- http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.1 doc.silverstripe.org
- http://open.silverstripe.org/changeset/107273 Patch
- http://open.silverstripe.org/ticket/5693 open.silverstripe.org
- http://www.openwall.com/lists/oss-security/2012/04/30/1 www.openwall.com
- http://www.openwall.com/lists/oss-security/2012/04/30/3 www.openwall.com
- http://www.openwall.com/lists/oss-security/2012/05/01/3 www.openwall.com
- http://dl.packetstormsecurity.net/1006-exploits/silverstripe-shell.txt Exploit
- http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.8 doc.silverstripe.org
- http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.1 doc.silverstripe.org
- http://open.silverstripe.org/changeset/107273 Patch
- http://open.silverstripe.org/ticket/5693 open.silverstripe.org
- http://www.openwall.com/lists/oss-security/2012/04/30/1 www.openwall.com
- http://www.openwall.com/lists/oss-security/2012/04/30/3 www.openwall.com
- http://www.openwall.com/lists/oss-security/2012/05/01/3 www.openwall.com