Description
ClipBucket version 2.6 and earlier contains a critical vulnerability in the ofc_upload_image.php script located at /admin_area/charts/ofc-library/. This endpoint allows unauthenticated users to upload arbitrary files, including executable PHP scripts. Once uploaded, the attacker can access the file via a predictable path and trigger remote code execution.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
ClipBucket LLC ClipBucket
Default version status: unaffected
0 to ≤ 2.6affected
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/clipbucket_upload_exec.rb ↗
- https://packetstorm.news/files/id/123480 ↗
- https://github.com/arslancb/clipbucket ↗
- https://clipbucket.com/ ↗
- https://www.vulncheck.com/advisories/clipbucket-arbitrary-file-upload-rce ↗