access2asp 'default_Image.asp' Arbitrary File Upload Vulnerability

Bugtraq ID:	33956
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 02 2009 12:00AM
Updated:	Mar 04 2009 06:46PM
Credit:	mr.al7rbi
Vulnerable:	access2asp access2asp 4.6 access2asp access2asp 4.5
Not Vulnerable:

access2asp 'default_Image.asp' Arbitrary File Upload Vulnerability

The 'access2asp' tool is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the software fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

This issue affects access2asp 4.6; other versions may also be affected.

access2asp 'default_Image.asp' Arbitrary File Upload Vulnerability

Attackers may exploit this issue via a browser.

access2asp 'default_Image.asp' Arbitrary File Upload Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

access2asp 'default_Image.asp' Arbitrary File Upload Vulnerability

References:

• Access2ASP Home Page (Access2ASP )