CVE-2008-7209

CVE-2008-7209 describes an unrestricted file upload vulnerability in OneCMS 2.4, and potentially earlier versions, specifically within the add2 action of a_upload.php. This flaw allows remote attackers to execute arbitrary code by uploading files with executable extensions, even if they have a safe content type like image/gif, and then directly accessing these files. With a CVSS score of 7.5, this vulnerability is considered highly severe, indicating a high potential for compromise. It requires no authentication (Au:N) and has low attack complexity (AC:L), meaning it can be exploited easily over the network (AV:N) to achieve partial confidentiality, integrity, and availability impacts (C:P/I:P/A:P). While there is an ExploitDB entry (EDB-4857) that mentions an upload vulnerability for OneCMS 2.4, it also includes SQL injection, and there's no indication of active exploitation (KEV: No). Community discussion and media coverage are minimal, suggesting low public attention.