CVE-2015-1371

Name of the Vulnerable Software and Affected Versions ferretCMS version 1.0.4-alpha

Description The issue allows remote administrators to execute arbitrary code by uploading a file with an executable extension to the custom/uploads/ directory, and then accessing it via a direct request. This is due to an unrestricted file upload vulnerability.

Recommendations For ferretCMS version 1.0.4-alpha, restrict access to the custom/uploads/ directory to prevent direct execution of uploaded files, and consider implementing file type validation to prevent uploading files with executable extensions.