Personal Site Manager 0.3 Multiple Remote Vulnerabilities

Bugtraq ID:	33512
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 29 2009 12:00AM
Updated:	Feb 02 2009 04:09PM
Credit:	darkjoker
Vulnerable:	Personal Site Manager Personal Site Manager 0.3
Not Vulnerable:

Personal Site Manager 0.3 Multiple Remote Vulnerabilities

Personal Site Manager is prone to multiple remote vulnerabilities:

- An arbitrary-file-upload vulnerability
- An authentication-bypass vulnerability

An attacker can exploit these issues to upload and execute arbitrary script code on an affected computer with the privileges of the webserver process or gain unauthorized access to the affected application.


Personal Site Manager 0.3 is vulnerable; other versions may also be affected.

Personal Site Manager 0.3 Multiple Remote Vulnerabilities

Attackers may exploit these issues via a browser.

The following exploit code is available:

• /data/vulnerabilities/exploits/33512.pl

Personal Site Manager 0.3 Multiple Remote Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Personal Site Manager 0.3 Multiple Remote Vulnerabilities

References:

• Vendor Homepage (Personal Site Manager)