KwsPHP Eskuel Module Arbitrary File Upload Vulnerability

Bugtraq ID:	28788
Class:	Input Validation Error
CVE:	CVE-2008-6201
Remote:	Yes
Local:	No
Published:	Apr 15 2008 12:00AM
Updated:	Mar 04 2009 02:16PM
Credit:	TsukasaGenesis && Ajax
Vulnerable:	KwsPHP KwsPHP 1.3.456 KwsPHP KwsPHP 1.0
Not Vulnerable:

KwsPHP Eskuel Module Arbitrary File Upload Vulnerability

The Eskuel module for KwsPHP is prone to a vulnerability that lets remote attackers upload and execute arbitrary code because the application fails to sanitize user-supplied input.

An attacker can leverage this issue to execute arbitrary code on an affected computer with the privileges of the webserver process.

Note that to exploit this issue, the attacker may require valid login credentials.

This issue affects KwsPHP 1.3.456; prior versions may also be affected.

KwsPHP Eskuel Module Arbitrary File Upload Vulnerability

Attackers may exploit this issue through a browser.

The following exploit code is available:

• /data/vulnerabilities/exploits/28788.php

KwsPHP Eskuel Module Arbitrary File Upload Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

KwsPHP Eskuel Module Arbitrary File Upload Vulnerability

References:

• KwsPHP Homepage (KwsPHP)
  
• KwsPHP (Upload) Remote Code Execution Exploit ([email protected])