PHP Upload Tool File Upload And Directory Traversal

Posted on Friday, November 17, 2006 @ 09:32:45 CET in Security
by Raven



CRITICAL: Moderately critical

IMPACT: Exposure of system information, Exposure of sensitive information, System access

SOFTWARE: PHP Upload Tool 1.x -

DESCRIPTION: Some vulnerabilities have been discovered in PHP Upload Tool, which can be exploited by malicious users to gain system access or by malicious people to expose sensitive information. The vulnerabilities are confirmed in version 1.0. Other versions may also be affected.

1) The bin/main_user.php script fails to validate the extension of an uploaded file. This can be exploited to upload files with arbitrary extensions (e.g. ".php") and execute arbitrary PHP code on the server. Successful exploitation requires valid user credentials.

2) Input passed to the "filename" parameter in bin/download.php is not properly sanitised before being used to download files. Successful exploitation allows for downloading of arbitrary files on the system, e.g. "/etc/passwd" or "conf/users.conf" (the product's usernames and password hashes).

SOLUTION: Edit the source code to ensure that input is properly verified and sanitised. Restrict access to the application, e.g. with an ".htaccess" file.

PROVIDED AND/OR DISCOVERED BY: Craig Heffner and an anonymous person

click Related        click Share
News ©

Site Info

Last SeenLast Seen
  • FireATST
  • Doulos
Server TrafficServer Traffic
  • Total: 383,991,875
  • Today: 18,382
Server InfoServer Info
  • Jun 17, 2019
  • 06:33 am CEST