CVE-2005-1031 File upload in n/a

Medium 5.0 Published 9 Apr 2005 Updated 7 Aug 2024

Remote attackers can upload arbitrary files to execute code if custom avatar uploads are enabled in RUNCMS.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2005-1031?

CVE-2005-1031 is a medium-severity vulnerability in n/a, published on 9 Apr 2005. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

RUNCMS 1.1A, and possibly other products based on e-Xoops (exoops), when "Allow custom avatar upload" is enabled, does not properly verify uploaded files, which allows remote attackers to upload arbitrary files.

Which versions are affected by CVE-2005-1031?

It affects 2 products.

Products include E-Xoops E-Xoops, Runcms Runcms.

How do I fix CVE-2005-1031?

No fix has been published for CVE-2005-1031 yet. Limit exposure of the affected software until one is available.

Is CVE-2005-1031 being exploited?

There is no known exploitation of CVE-2005-1031 in the wild and no public exploit code.

Sources

Also known as GHSA-6h83-jc39-4w5p.