CVE-2015-7309

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it.

Metrics

CVSS 2.0 6.5/10AV:N/AC:L/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://blog.curesec.com/article/blog/Bolt-224-Code-Execution-44.htmlExploit
http://packetstormsecurity.com/files/133539/CMS-Bolt-2.2.4-File-Upload.htmlExploit
http://seclists.org/fulldisclosure/2015/Aug/66Exploit
http://www.rapid7.com/db/modules/exploit/multi/http/bolt_file_uploadExploit
https://bolt.cm/newsitem/bolt-2-2-5-releasedPatch, Vendor Advisory
https://www.exploit-db.com/exploits/38196/Exploit
http://blog.curesec.com/article/blog/Bolt-224-Code-Execution-44.htmlExploit
http://packetstormsecurity.com/files/133539/CMS-Bolt-2.2.4-File-Upload.htmlExploit
http://seclists.org/fulldisclosure/2015/Aug/66Exploit
http://www.rapid7.com/db/modules/exploit/multi/http/bolt_file_uploadExploit
https://bolt.cm/newsitem/bolt-2-2-5-releasedPatch, Vendor Advisory
https://www.exploit-db.com/exploits/38196/Exploit

Timeline

Published: Sep 22, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-73106.5McAfee Enterprise Security Manager (ESM), Enterprise Security Manager/Log Manager (ESMLM), and Enterprise Security Manager/Receiver (ESMREC)CVE-2015-73113.6libxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag on disks when using the qemu-xen device model, which allows loca CVE-2015-73124.4Multiple race conditions in the Advanced Union Filesystem (aufs) aufs3-mmap.patch and aufs4-mmap.patch patches for the Linux kernel 3.x and CVE-2015-73135.5LibTIFF before 4.0.7 allows remote attackers to cause a denial of service (memory consumption and crash) via a crafted tiff file.CVE-2015-73144.3The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-fil CVE-2015-73155.9Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote att CVE-2015-73166.1Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x CVE-2015-73176.8Kupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7 allows remote authenticated users to edit Kupu CVE-2015-73187.5Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses.CVE-2015-73197.5SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 fo CVE-2015-73204.3Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calenda CVE-2015-73225.0The Secure Meeting (Pulse Collaboration) in Pulse Connect Secure (formerly Juniper Junos Pulse) before 7.1R22.1, 7.4, 8.0 before 8.0R11, and