PHP Upload Tool File Upload And Directory Traversal

Posted on Friday, November 17, 2006 @ 09:32:45 PST in Security
by Raven

SECUNIA ADVISORY ID: SA22973

VERIFY ADVISORY: http://secunia.com/advisories/22973/

CRITICAL: Moderately critical

IMPACT: Exposure of system information, Exposure of sensitive information, System access

SOFTWARE: PHP Upload Tool 1.x - http://secunia.com/product/12655/

DESCRIPTION: Some vulnerabilities have been discovered in PHP Upload Tool, which can be exploited by malicious users to gain system access or by malicious people to expose sensitive information. The vulnerabilities are confirmed in version 1.0. Other versions may also be affected.

1) The bin/main_user.php script fails to validate the extension of an uploaded file. This can be exploited to upload files with arbitrary extensions (e.g. ".php") and execute arbitrary PHP code on the server. Successful exploitation requires valid user credentials.

2) Input passed to the "filename" parameter in bin/download.php is not properly sanitised before being used to download files. Successful exploitation allows for downloading of arbitrary files on the system, e.g. "/etc/passwd" or "conf/users.conf" (the product's usernames and password hashes).

SOLUTION: Edit the source code to ensure that input is properly verified and sanitised. Restrict access to the application, e.g. with an ".htaccess" file.

PROVIDED AND/OR DISCOVERED BY: Craig Heffner and an anonymous person

ORIGINAL ADVISORY: 2) http://www.craigheffner.com/security/exploits/upload_tool_php.txt
 
 
click Related        click Share
 
News ©

Site Info v2.2.2

Last SeenLast Seen
Server TrafficServer Traffic
  • Total: 369,890,329
  • Today: 22,137
Server InfoServer Info
  • Oct 22, 2018
  • 06:49 am PDT
 
 

Daily Inspiration