7.5high
CVE-2008-02331 exploit
Unrestricted file upload vulnerability in Zero CMS 1.0 Alpha and earlier allows remote attackers to bypass intended access restrictions and…
Published 18 y ago · modified 4 mo ago · JSON
CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.2%
percentile 83%
Public exploits
1
Exploit-DB
Summary
Unrestricted file upload vulnerability in Zero CMS 1.0 Alpha and earlier allows remote attackers to bypass intended access restrictions and upload and execute arbitrary files by uploading an avatar file with an accepted Content-Type such as image/jpeg.
Exploit prediction (EPSS)
2.21% probability of exploitation in the next 30 days, higher than 83% of all scored CVEs.
Exploits and detections
- EDB-4864 ZeroCMS 1.0 Alpha - Arbitrary File Upload / SQL Injection · webapps · 2008-01-08
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
- CWE-264 Permissions, Privileges, and Access Controls
References
- packetstormsecurity.org /0801-exploits/zerocms-sql.txt · x_refsource_MISC, x_transferred
- exploit-db.com /exploits/4864 · exploit, x_refsource_EXPLOIT-DB, x_transferred
Sources
- CVE List: CVE-2008-0233
- NVD: CVE-2008-0233
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.