Unrestricted file upload vulnerability in asys/site/files.php in Adminsystems CMS before 4.0.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in upload/files/.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1604
Reference (s):
- BID:72605
- URL: http://www.securityfocus.com/bid/72605
- https://github.com/kneecht/adminsystems/issues/1
- https://github.com/kneecht/adminsystems/releases/tag/4.0.2
- FULLDISC:20150213 Reflecting XSS vulnerabitlies, unrestricted file upload and underlaying CSRF in Landsknecht Adminsystems CMS v. 4.0.1 (DEV, beta version)