BID:13831

I-Man File Attachments Remote Arbitrary PHP Script Execution Vulnerability

Info

I-Man File Attachments Remote Arbitrary PHP Script Execution Vulnerability

Bugtraq ID:	13831
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 01 2005 12:00AM
Updated:	Jun 01 2005 12:00AM
Credit:	Reported by the vendor.
Vulnerable:	I-Man I-Man 0.9 I-Man I-Man 0.8 I-Man I-Man 0.7 I-Man I-Man 0.6 I-Man I-Man 0.5 I-Man I-Man 0.4 I-Man I-Man 0.3 I-Man I-Man 0.2

Not Vulnerable:	I-Man I-Man 1.0

Discussion

I-Man File Attachments Remote Arbitrary PHP Script Execution Vulnerability

I-Man is affected by a remote PHP script execution vulnerability.

The application fails to verify if file attachments uploaded to the server are PHP scripts.

This issue can facilitate unauthorized access to an affected computer.

I-Man version 0.9 and prior are affected.

Exploit / POC

I-Man File Attachments Remote Arbitrary PHP Script Execution Vulnerability

An exploit is not required.

Solution / Fix

I-Man File Attachments Remote Arbitrary PHP Script Execution Vulnerability

Solution:
The vendor has released I-Man version 1.0 to address this issue.

I-Man I-Man 0.2