WebGUI - Arbitrary perl code can be executed by any user with upload permission - Content Management System | CMS | Open Source Content Management | Web Application Framework

Username Password

Arbitrary perl code can be executed by any user with upload permission (#8980)

Issue

Any user with permission to upload files to the server can upload a perl module, then cause the server to execute it using a properly formatted URL.

Solution Summary

Fixed.

Comments

Graham 10/27/2008 6:40 pm	Fixed in 7.5.30.
Graham 10/27/2008 6:42 pm	Fixed for 7.6.2. Attached patch for WebGUI 7.4 and other versions.

Details

Ticket Status	Resolved
Rating
Submitted By	Graham
Date Submitted	2008-10-27
Assigned To	unassigned
Date Assigned	2023-03-22
Assigned By
Severity	Fatal (can't continue until this is resolved)
What's the bug in?	WebGUI Stable
WebGUI / WRE Version
URL	bugs/tracker/8980

Keywords

Related Files

Ticket History