CVE-2013-1668

published 2014-05-23

CVE-2013-1668: The uploadFile function in upload/index.php in CosCMS before 1.822 allows remote administrators to execute arbitrary commands via shell metacharacters in the…

Priority P2 60 high 8.5 CVSS 2.0

AV N AC M Au S C C I C A C

EXPLOIT

The uploadFile function in upload/index.php in CosCMS before 1.822 allows remote administrators to execute arbitrary commands via shell metacharacters in the name of an uploaded file.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
coscms	coscms	<= 1.721	—
coscms	coscms	—	—
coscms	coscms	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /gallery/upload/index↗

path upload/index.php↗

filename 1 & ls -la > file.txt↗

path /gallery/upload/file.txt↗

• → Monitor HTTP POST requests to /gallery/upload/index containing multipart/form-data where the 'file' field's filename parameter includes shell metacharacters (e.g., &, |, ;, >, <). ↗
• → Inspect the $_FILES['file']['name'] value passed to PHP exec() in upload/index.php for shell metacharacters indicative of command injection. ↗
• → Look for the multipart boundary pattern '-----------------------------21456260222104' in HTTP POST bodies as a PoC-specific artifact, though attackers may vary this value. ↗

• · Successful exploitation requires the attacker to be authenticated with file upload privileges; user registration is disabled by default, limiting the attack surface to compromised or malicious admin accounts. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78