CVE-2015-1587 — AI Deep Analysis Summary

🚨 **Essence**: Arbitrary File Upload in Maarch Letterbox. 📉 **Consequences**: Attackers upload PHP files to execute arbitrary code. 💥 **Impact**: Full system compromise via web shell.

🛡️ **CWE**: CWE-434 (Unrestricted Upload of File with Dangerous Type). 🐛 **Flaw**: The `file_to_index.php` script fails to validate file extensions or content, allowing malicious payloads.

🏢 **Vendor**: Maarch (French company). 📦 **Affected**: Maarch Letterbox v2.8 & earlier. 📦 **Also**: GEC/GED v1.4 & earlier. 📅 **Published**: Feb 19, 2015.

💻 **Privileges**: Remote Code Execution (RCE). 📂 **Data**: Access to server files, databases, and internal systems. 🕵️ **Action**: Hackers run PHP commands directly via uploaded scripts.

🔓 **Auth**: Likely Low/None for initial upload vector. 🌐 **Config**: Requires direct request to `file_to_index.php`. ⚠️ **Threshold**: Low. Simple HTTP POST with a PHP file triggers it.

💣 **Public Exp**: YES. 📜 **Ref**: Exploit-DB #35113. 🌍 **Status**: Wild exploitation possible. PacketStorm and OSVDB entries confirm active availability.

🔍 **Check**: Scan for `file_to_index.php` endpoint. 📤 **Test**: Attempt upload of `.php` or `.phtml` files. 🛑 **Alert**: If server accepts and serves the file, it's vulnerable.

🩹 **Fix**: Upgrade to versions > 2.8 (Letterbox) or > 1.4 (GEC/GED). 📝 **Note**: Official patch details not in data, but version cutoff is clear. 🔄 **Action**: Update immediately.

🚧 **Workaround**: Block access to `file_to_index.php` via WAF. 🚫 **Restrict**: Disable file upload features if not needed. 🔒 **Validate**: Implement strict server-side file type checking.

🔥 **Priority**: CRITICAL. 🚀 **Urgency**: High. RCE allows total takeover. 📉 **Risk**: Unpatched systems are wide open to automated bots. Act NOW.