PHP-Nuke DownloadsPlus Module Arbitrary File Upload Vulnerability
BID:28919
Info
PHP-Nuke DownloadsPlus Module Arbitrary File Upload Vulnerability
| Bugtraq ID: | 28919 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-4767 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 24 2008 12:00AM |
| Updated: | May 07 2015 05:29PM |
| Credit: | ZoRLu |
| Vulnerable: |
PHP-Nuke DownloadsPlus Module 0 |
| Not Vulnerable: | |
Discussion
PHP-Nuke DownloadsPlus Module Arbitrary File Upload Vulnerability
The DownloadsPlus module for PHP-Nuke is prone to a vulnerability that lets remote attackers upload and execute arbitrary code because the application fails to sanitize user-supplied input. This issue permits attackers to upload arbitrary files with '.htm', '.html', or '.txt' extensions.
An attacker can leverage this issue to execute arbitrary code on an affected computer with the privileges of the webserver process.
Note that to exploit this issue, the attacker may require valid login credentials.
The DownloadsPlus module for PHP-Nuke is prone to a vulnerability that lets remote attackers upload and execute arbitrary code because the application fails to sanitize user-supplied input. This issue permits attackers to upload arbitrary files with '.htm', '.html', or '.txt' extensions.
An attacker can leverage this issue to execute arbitrary code on an affected computer with the privileges of the webserver process.
Note that to exploit this issue, the attacker may require valid login credentials.
Exploit / POC
PHP-Nuke DownloadsPlus Module Arbitrary File Upload Vulnerability
Attackers may exploit this issue through a browser.
The following example URI is available:
http://www.example.com/phpnuke/upload_category/filename.html
Attackers may exploit this issue through a browser.
The following example URI is available:
http://www.example.com/phpnuke/upload_category/filename.html
Solution / Fix
PHP-Nuke DownloadsPlus Module Arbitrary File Upload Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].