CVEvulnerability
CVE-2014-5298
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-10-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
- Weaknesses
- CWE-264
Description
FileUploadsFilter.php in X2Engine 4.1.7 and earlier, when running on case-insensitive file systems, allows remote attackers to bypass the upload blacklist and conduct unrestricted file upload attacks by uploading a file with an executable extension that contains uppercase letters, as demonstrated using a PHP program.
Affected configurations
• x2engine x2engine (<= 4.1.7)
Related
Weakness · not in database (1)
References
- http://karmainsecurity.com/KIS-2014-10 karmainsecurity.com
- http://packetstormsecurity.com/files/128353/X2Engine-4.1.7-Unrestricted-File-Upload.html packetstormsecurity.com
- http://seclists.org/fulldisclosure/2014/Sep/78 seclists.org
- http://www.securityfocus.com/archive/1/533514/100/0/threaded www.securityfocus.com
- https://cert-portal.siemens.com/productcert/pdf/ssa-234763.pdf cert-portal.siemens.com
- https://github.com/X2Engine/X2Engine/blob/master/CHANGELOG.md github.com
- http://karmainsecurity.com/KIS-2014-10 karmainsecurity.com
- http://packetstormsecurity.com/files/128353/X2Engine-4.1.7-Unrestricted-File-Upload.html packetstormsecurity.com
- http://seclists.org/fulldisclosure/2014/Sep/78 seclists.org
- http://www.securityfocus.com/archive/1/533514/100/0/threaded www.securityfocus.com
- https://cert-portal.siemens.com/productcert/pdf/ssa-234763.pdf cert-portal.siemens.com
- https://github.com/X2Engine/X2Engine/blob/master/CHANGELOG.md github.com