Joomla! User Home Pages Component 'com_uhp' Arbitrary File Upload Vulnerability

Bugtraq ID:	27780
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 13 2008 12:00AM
Updated:	Feb 14 2008 12:06AM
Credit:	S@BUN is credited with the discovery of this vulnerability.
Vulnerable:	Ravenswood IT Services UHP 0.7
Not Vulnerable:

Joomla! User Home Pages Component 'com_uhp' Arbitrary File Upload Vulnerability

The Joomla! User Home Pages component is prone to a vulnerability that lets attackers upload arbitrary files because it fails to verify the type of file being uploaded.

Exploiting this issue could allow attackers to upload and execute arbitrary script code in the context of the affected webserver process.

Joomla! User Home Pages Component 'com_uhp' Arbitrary File Upload Vulnerability

Attackers may exploit this issue through a browser.

Joomla! User Home Pages Component 'com_uhp' Arbitrary File Upload Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Joomla! User Home Pages Component 'com_uhp' Arbitrary File Upload Vulnerability

References:

• joomla upload php code or picture (com_uhp) ([email protected] )
  
• UHP Download Page (Ravenswood IT Services)