CVE-2008-7026

Published: Aug 21, 2009Modified: Apr 23, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Unrestricted file upload vulnerability in filesystem3.class.php in eFront 3.5.1 build 2710 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension as an avatar, then accessing it via a direct request to the file in (1) student/avatars/ or (2) professor/avatars/.

Affected (10)

Products: Efrontlearning: Efront

Efrontlearning

1 product

Efront

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Efrontlearning Efront	Up to 3.5.1
Efrontlearning Efront	Version 3.1.0
Efrontlearning Efront	Version 3.1.2
Efrontlearning Efront	Version 3.1.3
Efrontlearning Efront	Version 3.1.4
Efrontlearning Efront	Version 3.5.0
Efrontlearning Efront	Version 3.5.0 beta1
Efrontlearning Efront	Version 3.5.0 beta2
Efrontlearning Efront	Version 3.5.0 beta3
Efrontlearning Efront	Version 3.5.0 beta4