Threat database

An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component.

File Thingie 2.5.7 is vulnerable to Directory Traversal. A malicious user can leverage the "create folder from url" functionality of the application to read arbitrary files on the target system.

File Thingie 2.5.7 is vulnerable to Cross Site Scripting (XSS). A malicious user can leverage the "upload file" functionality to upload a file with a crafted file name used to trigger a Javascript payload.

File Thinghie 2.5.7 is vulnerable to Cross Site Scripting (XSS). A malicious user can leverage the "dir" parameter of the GET request to invoke arbitrary javascript code.

CVE-2023-53942 is a critical authenticated file upload vulnerability in File Thingie version 2.5.7 that allows attackers with limited privileges to upload malicious PHP zip archives. By uploading and extracting a crafted PHP payload, attackers can execute arbitrary system commands on the affected web server without user interaction. This vulnerability has a CVSS 4.0 score of 9.4, indicating a critical severity level due to its high impact on confidentiality, integrity, and availability. Although no known exploits are currently reported in the wild, the ease of exploitation and potential for full system compromise make this a significant threat. European organizations using File Thingie 2.5.