A security issue and a vulnerability have been reported in chillyCMS, which can be exploited by malicious users to compromise a vulnerable system and by malicious people to bypass certain security restrictions.

1) An error when redirecting unauthenticated users can be exploited to bypass the authentication system.

2) The admin/design.site.php script allows the upload of certain archive files to a folder inside the webroot. This can be exploited to e.g. upload and decompress a ZIP archive containing a PHP script and subsequently execute arbitrary PHP code.

The vulnerabilities are reported in version 1.3.0. Other versions may also be affected.

Solution
Use another product.

Provided and/or discovered by
Abhi M Balakrishnan

Original Advisory
Abhi M Balakrishnan:
http://www.exploit-db.com/exploits/24507/

Deep Links
Links available to Secunia VIM customers