CWE Code: 94
Vulnerability Type: privilege_escalation
CVSS Score: 6.0
CWE Name:  Improper Control of Generation of Code ('Code Injection')
Summary: the setname function in filesystem/file.php in silverstripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with cms author privileges to execute arbitrary php code by changing the extension of an uploaded file.
Access Authentication: SINGLE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2012-08-26
Last Modified Date: 2012-08-27
You are a cybersecurity expert assistant. Provide detailed information about vulnerabilities in a clear and structured format.
system
Please provide details about this vulnerability:  Improper Control of Generation of Code ('Code Injection').
user
CWE Code: 94
Vulnerability Type: privilege_escalation
CVSS Score: 6.0
CWE Name:  Improper Control of Generation of Code ('Code Injection')
Summary: the setname function in filesystem/file.php in silverstripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with cms author privileges to execute arbitrary php code by changing the extension of an uploaded file.
Access Authentication: SINGLE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2012-08-26
Last Modified Date: 2012-08-27
assistant