TomatoCMS contains a flaw that may allow an attacker to to upload arbitrary files inside the webroot. The issue is triggered by an error in the validation of uploading images when creating a new article.
Classification
Location:
Remote / Network Access
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Solution:
Solution Unknown
Exploit:
Exploit Unknown
Disclosure:
Uncoordinated Disclosure
OSVDB:
Web Related
Technical
Successful exploitation of this vulnerability requires "Add new article", "Upload file to server", and "Browse uploaded files" permissions.
Solution
OSVDB is not aware of a solution for this vulnerability.
This product uses the Daylife API but is not endorsed or certified by Daylife.
This section lists the latest news and blogs found via the daylife API (and for older items, the technorati API), which mention or otherwise discuss this vulnerability.
