eZoneScripts Living Local Arbitrary File Upload Vulnerability
BID:32760
Info
eZoneScripts Living Local Arbitrary File Upload Vulnerability
| Bugtraq ID: | 32760 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 10 2008 12:00AM |
| Updated: | Dec 12 2008 08:21PM |
| Credit: | Bgh7 |
| Vulnerable: |
eZoneScripts Living Local 1.1 eZoneScripts Living Local 0 |
| Not Vulnerable: | |
Discussion
eZoneScripts Living Local Arbitrary File Upload Vulnerability
eZoneScripts Living Local is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to properly verify the file extensions of uploaded files.
An attacker can exploit this issue to upload arbitrary files and execute malicious code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
Living Local 1.1 is vulnerable; other versions may also be affected.
eZoneScripts Living Local is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to properly verify the file extensions of uploaded files.
An attacker can exploit this issue to upload arbitrary files and execute malicious code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
Living Local 1.1 is vulnerable; other versions may also be affected.
Exploit / POC
eZoneScripts Living Local Arbitrary File Upload Vulnerability
Attackers can exploit this issue via a browser.
Attackers can exploit this issue via a browser.
Solution / Fix
eZoneScripts Living Local Arbitrary File Upload Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
eZoneScripts Living Local Arbitrary File Upload Vulnerability
References:
References:
- Living Local Homepage (eZoneScripts)