WikyBlog Arbitrary File Upload Vulnerability

Bugtraq ID:	33964
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 03 2009 12:00AM
Updated:	Mar 04 2009 11:36PM
Credit:	WikyBlog
Vulnerable:	WikyBlog WikyBlog 1.7.1
Not Vulnerable:	WikyBlog WikyBlog 1.7.1.1

WikyBlog Arbitrary File Upload Vulnerability

WikyBlog is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the software fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

WikyBlog 1.7.1 is vulnerable; other versions may also be affected.

WikyBlog Arbitrary File Upload Vulnerability

Attackers may exploit this issue via a browser.

WikyBlog Arbitrary File Upload Vulnerability

Solution:
The vendor has released updates. Please see the references for more information.


WikyBlog WikyBlog 1.7.1

• WikyBlog WikyBlog-1.7.1.1.tar.gz
  http://downloads.sourceforge.net/wikyblog/WikyBlog-1.7.1.1.tar.gz

WikyBlog Arbitrary File Upload Vulnerability

References:

• WikyBlog Homepage (WikyBlog)
  
• WikyBlog Release Notes (WikyBlog)