PHP F1 Max's File Uploader 'index.php' Arbitrary File Upload Vulnerability

Bugtraq ID:	27285
Class:	Input Validation Error
CVE:	CVE-2008-0373
Remote:	Yes
Local:	No
Published:	Jan 15 2008 12:00AM
Updated:	May 07 2015 05:33PM
Credit:	Xcross87 is credited with the discovery of this issue.
Vulnerable:	PHP F1 Max's File Uploader 0
Not Vulnerable:

PHP F1 Max's File Uploader 'index.php' Arbitrary File Upload Vulnerability

Max's File Uploader is prone to an arbitrary file-upload vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to upload arbitrary files and execute malicious code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

PHP F1 Max's File Uploader 'index.php' Arbitrary File Upload Vulnerability

Attackers may exploit this issue via a browser.

PHP F1 Max's File Uploader 'index.php' Arbitrary File Upload Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

PHP F1 Max's File Uploader 'index.php' Arbitrary File Upload Vulnerability

References:

• Max's File Uploader Homepage (PHP F1)
  
• Max's File Uploader File Upload Vulnerability ([email protected])