Vulnerabilities > CVE-2015-1587 - Arbitrary File Upload vulnerability in Maarch Gec/Ged and Letterbox
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
Unrestricted file upload vulnerability in file_to_index.php in Maarch LetterBox 2.8 and earlier and GEC/GED 1.4 and earlier allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a request to a predictable filename in tmp/. <a href="http://cwe.mitre.org/data/definitions/434.html">CWE-434: Unrestricted Upload of File with Dangerous Type</a>
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 2 |
Exploit-Db
| description | MAARCH 1.4 - Arbitrary File Upload. CVE-2015-1587. Webapps exploit for php platform |
| file | exploits/php/webapps/35113.php |
| id | EDB-ID:35113 |
| last seen | 2016-02-04 |
| modified | 2014-10-29 |
| platform | php |
| port | 80 |
| published | 2014-10-29 |
| reporter | Adrien Thierry |
| source | https://www.exploit-db.com/download/35113/ |
| title | MAARCH 1.4 - Arbitrary File Upload |
| type | webapps |
Metasploit
| description | This module exploits a file upload vulnerability on Maarch LetterBox 2.8 due to a lack of session and file validation in the file_to_index.php script. It allows unauthenticated users to upload files of any type and subsequently execute PHP scripts in the context of the web server. |
| id | MSF:EXPLOIT/UNIX/WEBAPP/MAARCH_LETTERBOX_FILE_UPLOAD |
| last seen | 2020-06-13 |
| modified | 2018-10-01 |
| published | 2015-02-12 |
| references | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1587 |
| reporter | Rapid7 |
| source | https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/unix/webapp/maarch_letterbox_file_upload.rb |
| title | Maarch LetterBox Unrestricted File Upload |
Packetstorm
| data source | https://packetstormsecurity.com/files/download/130383/maarch_letterbox_file_upload.rb.txt |
| id | PACKETSTORM:130383 |
| last seen | 2016-12-05 |
| published | 2015-02-12 |
| reporter | Rob Carr |
| source | https://packetstormsecurity.com/files/130383/Maarch-LetterBox-2.8-Unrestricted-File-Upload.html |
| title | Maarch LetterBox 2.8 Unrestricted File Upload |