ESTsoft InternetDisk Arbitrary File Upload and Script Execution Vulnerability

Bugtraq ID:	18279
Class:	Input Validation Error
CVE:	CVE-2006-2899
Remote:	Yes
Local:	No
Published:	Jun 05 2006 12:00AM
Updated:	May 18 2010 01:42PM
Credit:	Kil13r discovered this issue.
Vulnerable:	ESTsoft Internetdisk 0
Not Vulnerable:

ESTsoft InternetDisk Arbitrary File Upload and Script Execution Vulnerability

ESTsoft InternetDisk is prone to an arbitrary file-upload and script-execution vulnerability.

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

This issue affects versions of InternetDisk downloaded prior to 19 April, 2006.

ESTsoft InternetDisk Arbitrary File Upload and Script Execution Vulnerability

This issue can be exploited with a web client.

The following URI will demonstrate a filename that attackers may use to exploit this issue:
http://www.example.com/WebLink/yourid/somephpcode.php.kr

ESTsoft InternetDisk Arbitrary File Upload and Script Execution Vulnerability

Solution:
Updates are available. Please see contact the vendor for more information.
[email protected]

ESTsoft InternetDisk Arbitrary File Upload and Script Execution Vulnerability

References:

• InternetDisk Product Page (ESTsoft)
  
• [Kil13r-SA-20060606] ESTsoft InternetDISK Arbitary Code Execution Vulnerability ([email protected])