PHPFormGenerator Arbitrary File Upload Vulnerability

Bugtraq ID:	18768
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 03 2006 12:00AM
Updated:	Jul 04 2006 08:14PM
Credit:	Donnie Werner is credited with the discovery of this vulnerability.
Vulnerable:	phpFormGenerator phpFormGenerator 2.09c
Not Vulnerable:

PHPFormGenerator Arbitrary File Upload Vulnerability

phpFormGenerator is prone to an arbitrary file-upload vulnerability.

An attacker can exploit this vulnerability to upload malicious script code, which will be executed in the context of the webserver process.

An attacker may compromise the application by uploading and executing malicious PHP scripts.

phpFormGenerator 2.09c is reported vulnerable. Other versions may be affected as well.

PHPFormGenerator Arbitrary File Upload Vulnerability

This issue can be exploited with a web client.

PHPFormGenerator Arbitrary File Upload Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected].

PHPFormGenerator Arbitrary File Upload Vulnerability

References:

• EXPL-A-2006-004 exploitlabs.com Advisory 049 (Donnie Werner)
  
• phpFormGenerator Home Page (phpFormGenerator)