Vulnerability in Activecampaign 1-2-All Broadcast Email
CVE-2007-2630
Incomplete blacklist vulnerability in filemanager/browser/default/connectors/php/config.php in the FCKeditor module, as used in ActiveCampaign 1-2-All (aka 12All) 4.50 through 4.53.13, and possibly other products, allows remote authenticated administrators to upload and possibly execute .php4 and .php5 files via unspecified vectors. NOTE: this issue is reachable through filemanager/browser/default/browser.html.
EPSS: 0.013 (67.7th percentile) — read the EPSS interpretation.
Affected products
- Activecampaign 1-2-all_broadcast_email — versions 4.5, 4.53.13
- N/a — versions n/a
References
- cve@mitre.org (Patch, x_refsource_MISC)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (x_refsource_OSVDB, vdb-entry)
- cve@mitre.org (vdb-entry, x_refsource_BID)