CVE-2005-4814 File upload in n/a

High 7.5 Published 31 Oct 2006 Updated 16 Sep 2024

Remote attackers can upload and execute arbitrary PHP code via .phtml files in Segue CMS if Apache is configured to process them.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2005-4814?

CVE-2005-4814 is a high-severity vulnerability in n/a, published on 31 Oct 2006. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Unrestricted file upload vulnerability in Segue CMS before 1.3.6, when the Apache HTTP Server handles .phtml files with the PHP interpreter, allows remote attackers to upload and execute arbitrary PHP code by placing .phtml files in the userfiles/ directory.

Which versions are affected by CVE-2005-4814?

It affects 1 product.

Products include Middlebury College Segue Cms.

How do I fix CVE-2005-4814?

No fix has been published for CVE-2005-4814 yet. Limit exposure of the affected software until one is available.

Is CVE-2005-4814 being exploited?

There is no known exploitation of CVE-2005-4814 in the wild and no public exploit code.

Sources

Also known as GHSA-p37h-9c34-5f75.