Description
SocialEngine (SE) before 2.83 grants certain write privileges for templates, which allows remote authenticated administrators to execute arbitrary PHP code.
References
- socialengine-template-code-execution(43959) vdb-entry
- 20080722 Vulnerability: SocialEngine (SocialEngine.net) high risk security flaw mailing-list
- http://www.socialengine.net/news.php
- 4035 third-party-advisory
- 31203 third-party-advisory