6.5 - CVE-2015-1604

Executive Summary

Informations
Name	CVE-2015-1604	First vendor Publication	2015-02-19
Vendor	Cve	Last vendor Modification	2015-02-21

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:S/C:P/I:P/A:P)
Cvss Base Score	6.5	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Low
Cvss Expoit Score	8	Authentication	Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

Unrestricted file upload vulnerability in asys/site/files.php in Adminsystems CMS before 4.0.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in upload/files/.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1604

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-20	Improper Input Validation

Sources (Detail)

Source	Url
BID	http://www.securityfocus.com/bid/72605
CONFIRM	https://github.com/kneecht/adminsystems/issues/1 https://github.com/kneecht/adminsystems/releases/tag/4.0.2
FULLDISC	http://seclists.org/fulldisclosure/2015/Feb/50
MISC	http://packetstormsecurity.com/files/130394/Landsknecht-Adminsystems-CMS-4.0.... http://sroesemann.blogspot.de/2015/02/report-for-advisory-sroeadv-2015-14.html
MLIST	http://www.openwall.com/lists/oss-security/2015/02/13/11 http://www.openwall.com/lists/oss-security/2015/02/14/1 http://www.openwall.com/lists/oss-security/2015/02/14/5

Alert History

If you want to see full details history, please login or register.

Date	Informations
2021-04-22 01:47:20	Multiple Updates
2020-05-23 01:55:05	Multiple Updates
2020-05-23 00:44:29	Multiple Updates
2015-02-21 09:25:31	Multiple Updates
2015-02-19 21:24:57	First insertion