Description (CNA)
Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions saveWatermark() copied an uploaded file into a web-accessible directory using the client-supplied filename exactly as sent, with no extension check, no content check, and no filename sanitisation of any kind. An authenticated core.manage user could upload a .php file disguised with an image Content-Type header and execute it directly by requesting the resulting path.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| OrdaSoft.com / OrdaSoft Joomla Gallery free extension for Joomla | affected 1.0.0-6.2.6 |
| OrdaSoft.com / OrdaSoft Joomla Gallery extension for Joomla | affected 1.0.0-6.2.6 |
CWE
CWE-434
References
ADP enrichment
No English description supplied.
No references supplied.