CVE-2008-2742

CVE-2008-2742 describes an unrestricted file upload vulnerability in Achievo versions 1.2.0 through 1.3.2, specifically within the mcpuk file editor component. This flaw allows unauthenticated remote attackers to execute arbitrary code by uploading malicious files with a ".php" extension followed by a safe extension, then directly accessing the uploaded file. The vulnerability has a CVSS score of 7.5, indicating high severity due to its network-based attack vector, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. While not listed on the KEV catalog or Hot List, an exploit is publicly available on ExploitDB, though there is no evidence of active exploitation or significant community discussion.