CWE Code: 94
Vulnerability Type: privilege_escalation
CVSS Score: 6.0
CWE Name:  Improper Control of Generation of Code ('Code Injection')
Summary: the setname function in filesystem/file.php in silverstripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with cms author privileges to execute arbitrary php code by changing the extension of an uploaded file.
Access Authentication: SINGLE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2012-08-26
Last Modified Date: 2012-08-27