• News
• Infocus
• Foundations
• Microsoft
• Unix
• IDS
• Incidents
• Virus
• Pen-Test
• Firewalls
• Columnists
• Mailing Lists
• Newsletters
• Bugtraq
• Focus on IDS
• Focus on Linux
• Focus on Microsoft
• Forensics
• Pen-test
• Security Basics
• Vuln Dev
• Vulnerabilities
• Jobs
• Job Opportunities
• Resumes
• Job Seekers
• Employers
• Tools
• RSS
• News
• Vulns
• Security Research

• info
• discussion
• exploit
• solution
• references

Exponent CMS Image Upload Arbitrary Script Execution Vulnerability

Exponent CMS is prone to an arbitrary script execution vulnerability. This is due to a lack of proper sanitization of user-supplied input to the image upload portion of the application.

An attacker can include remote script code and execute it in the context of an affected server.

Versions 0.x are reported to be vulnerable; an upgrade to 0.94.6 is available.