Description
Glossword versions 1.8.8 through 1.8.12 contain an authenticated arbitrary file upload vulnerability. When deployed as a standalone application, the administrative interface (gw_admin.php) allows users with administrator privileges to upload files to the gw_temp/a/ directory. Due to insufficient validation of file type and path, attackers can upload and execute PHP payloads, resulting in remote code execution.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Glossword Team Glossword
Default version status: unknown
1.8.8 to ≤ 1.8.12affected
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/glossword_upload_exec.rb ↗
- https://www.exploit-db.com/exploits/24456 ↗
- https://www.exploit-db.com/exploits/24548 ↗
- https://github.com/glosswordteam/Glossword ↗
- https://sourceforge.net/projects/glossword/ ↗
- https://www.vulncheck.com/advisories/glossword-arbitrary-file-upload-rce ↗