‘Pulse CMS Arbitrary File Upload Vulnerability’

Summary

A vulnerability was discovered in Pulse CMS, which can be exploited by malicious users to compromise a vulnerable system.’

Credit:

‘The original article can be found at: http://secunia.com/secunia_research/2010-47/


Details

Vulnerable Systems:
 * Pulse CMS basic version 1.2.2
 * Pulse CMS basic version 1.2.3

Immune Systems:
 * Pulse CMS basic version 1.2.4 (Partial Fix)

An error in the validation of uploaded image files can be exploited to upload files with an arbitrary extension to a folder within the web root. This can be exploited to upload and execute arbitrary PHP code.

Successful exploitation requires authentication.

CVE Information:
CVE-2010-0993

Disclosure Timeline:
19/03/2010 – Vendor notified.
19/03/2010 – Vendor response.
08/04/2010 – Public disclosure.’

Categories: News