Description
The setName function in filesystem/File.php in SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with CMS author privileges to execute arbitrary PHP code by changing the extension of an uploaded file.
References
- [oss-security] 20120501 Re: CVE-request: SilverStripe before 2.4.4 mailing-list
- http://open.silverstripe.org/ticket/5693
- [oss-security] 20120430 CVE-request: SilverStripe before 2.4.4 mailing-list
- [oss-security] 20120430 Re: CVE-request: SilverStripe before 2.4.4 mailing-list
- http://dl.packetstormsecurity.net/1006-exploits/silverstripe-shell.txt
- http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.1
- http://open.silverstripe.org/changeset/107273
- http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.8