Secunia

Alexander Concha has reported a vulnerability in Graffity CMS, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to insecure restrictions on the "__utility/Telligent_Editor/editor/filemanager/browser/default/browser.html" script. This can be exploited to upload and execute files with arbitrary extensions.

Solution
The vendor recommends to delete the "__utility/Telligent_Editor/editor/filemanager" folder.

Provided and/or discovered by
Alexander Concha

Original Advisory
http://graffiticms.com/blog/security-issue/

Deep Links
Links available in Customer Area