CVE-2011-2745
Description
upload_handler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side JavaScript code to restrict the file extensions of uploaded files, which allows remote authenticated users to upload a .php file, and consequently execute arbitrary PHP code, via a write_post action to the default URI under admin/.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
Chyrp 2.x swfupload Extension - 'upload_handler.php' Arbitrary File Upload / Arbitrary PHP Code Execution
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| chyrp | chyrp | {"endIncluding":"2.0"} | |
References
- http://securityreason.com/securityalert/8314
- http://www.justanotherhacker.com/advisories/JAHx113.txt
- http://www.openwall.com/lists/oss-security/2011/07/13/5
- http://www.openwall.com/lists/oss-security/2011/07/13/6
- http://www.securityfocus.com/bid/48672
- http://securityreason.com/securityalert/8314
- http://www.justanotherhacker.com/advisories/JAHx113.txt
- http://www.openwall.com/lists/oss-security/2011/07/13/5
- http://www.openwall.com/lists/oss-security/2011/07/13/6
- http://www.securityfocus.com/bid/48672
CWEs
CWE-264
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.