Unscored severity · published Nov 22, 2005
CVE-2005-3765
Exponent CMS 0.96.3 and later versions performs a chmod on uploaded files to give them execute permissions, which allows remote attackers to execute arbitrary code
–
CVSS
2.7%
EPSS
No
On KEV
Description
Exponent CMS 0.96.3 and later versions performs a chmod on uploaded files to give them execute permissions, which allows remote attackers to execute arbitrary code.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EX
Exponent · Exponent
0.94; 0.95; 0.96.1; 0.96.3; 0.96.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-3765
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-3765
secunia.com
http://secunia.com/advisories/17505
Vendor Advisory
http://secunia.com/advisories/17655
Vendor Advisory
http://www.securityfocus.com/archive/1/417218
www.securityfocus.com
http://www.securityfocus.com/bid/15503
More from Exponent
–
CVE-2005-3767
Exponent CMS 0.96.3 and later versions does not properly restrict the types of uploaded files, which allows remote attackers to upload and execute PHP files
–
CVE-2005-3766
Exponent CMS 0.96.3 and later versions stores sensitive user pages under the web document root with insufficient access control even though certain permissions are specified,…
–
CVE-2005-3761
Cross-site scripting (XSS) vulnerability in Exponent CMS 0.96.3 and later versions allows remote attackers to inject arbitrary web script or HTML via (1) Javascript in forms…
–
CVE-2005-3762
SQL injection vulnerability in the navigation module (navigationmodule) in Exponent CMS 0.96.3 and later versions allows remote attackers to execute arbitrary SQL commands via the…
–
CVE-2005-3763
Exponent CMS 0.96.3 and later versions includes the full installation path in the base parameter to thumb.php, which allows remote attackers to obtain sensitive information