Using this vulnerability, an attacker could upload different file server PayPal formatov.Istochnikom vulnerability became an old version of CMS DotNetNuke, which allows you to upload files to the sites of the following formats: docx, xlsx, pptx, swf, jpg, jpeg, jpe, gif, bmp, png, doc, xls, ppt, pdf, txt, xml, xsl, css, zip and spin.
According to the expert, using the vulnerability by cybercriminals to upload malicious files. For example, downloading a malicious swf-file, they can create online XSS-vulnerability, with the infected files: docx, pptx, xls or pdf - upload BillMeLater client exploits, and in a file format hackers could download txt message letting deface site.
Experts argue that tried to load the shell, which would enable it to execute arbitrary code. However, his attempts were unsuccessful, as the server software has been updated in a timely manner.
