21degrees : Security Vulnerabilities, CVEs,
Unrestricted file upload vulnerability in the File Manager in the admin panel in Twentyone Degrees Symphony 1.7.01 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension to a directory specified in the destination parameter, then accessing the uploaded file via a direct request, as demonstrated using workspace/masters/.
Max CVSS
8.5
EPSS Score
1.03%
Published
2008-08-11
Updated
2017-09-29
SQL injection vulnerability in lib/class.admin.php in Twentyone Degrees Symphony 1.7.01 and earlier allows remote attackers to execute arbitrary SQL commands via the sym_auth cookie in a /publish/filemanager/ request to index.php.
Max CVSS
7.5
EPSS Score
0.25%
Published
2008-08-11
Updated
2017-09-29
2 vulnerabilities found