CVE-2014-125126
BaseFortify
Publication date: 2025-07-31
Last updated on: 2025-07-31
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| simple_e-document | simple_e-document | 3.1 |
| simple_e-document | simple_e-document | 3.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an unrestricted file upload issue in Simple E-Document versions 3.0 to 3.1. An attacker can bypass authentication by sending a specific cookie (access=3) with HTTP requests, gaining access to the upload functionality without valid credentials. The upload mechanism does not restrict file types or validate input, allowing the attacker to upload malicious .php scripts. This can lead to remote code execution with the web server's privileges.
How can this vulnerability impact me? :
If exploited, this vulnerability allows an attacker to upload malicious scripts and execute code remotely on the server with the privileges of the web server user. This can lead to full system compromise, unauthorized access, data theft, or disruption of services.