CVE-2015-7309 : The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authent

The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it.

Published 2015-09-22 15:59:02

Updated 2021-01-04 18:20:02

Source MITRE

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2015-7309

Boltcms » Bolt
Versions up to, including, (<=) 2.2.0
cpe:2.3:a:boltcms:bolt:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2015-7309

EPSS FAQ

29.42%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 97 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2015-7309

CMS Bolt File Upload Vulnerability

Disclosure Date: 2015-08-17

First seen: 2020-04-26

exploit/multi/http/bolt_file_upload

Bolt CMS contains a flaw that allows an authenticated remote attacker to execute arbitrary PHP code. This module was tested on version 2.2.4. Authors: - Tim Coen - Roberto Soares Espreto <robertoespreto@gmail.com>

More information

CVSS scores for CVE-2015-7309

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:P	8.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2015-7309

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-7309

http://packetstormsecurity.com/files/133539/CMS-Bolt-2.2.4-File-Upload.html

CMS Bolt 2.2.4 File Upload ≈ Packet Storm
Exploit
http://blog.curesec.com/article/blog/Bolt-224-Code-Execution-44.html

Bolt 2.2.4: Code Execution - Cureblog
Exploit
https://www.exploit-db.com/exploits/38196/

CMS Bolt - Arbitrary File Upload (Metasploit)
Exploit
http://seclists.org/fulldisclosure/2015/Aug/66

Full Disclosure: Bolt 2.2.4 - Code Execution
Exploit
https://bolt.cm/newsitem/bolt-2-2-5-released

Bolt 2.2.5 released. | Bolt CMS
Patch;Vendor Advisory
http://www.rapid7.com/db/modules/exploit/multi/http/bolt_file_upload

CMS Bolt File Upload Vulnerability
Exploit

Jump to