Family Connections 'fcms/upload.php' Arbitrary File Upload Vulnerability
BID:34368
Info
Family Connections 'fcms/upload.php' Arbitrary File Upload Vulnerability
| Bugtraq ID: | 34368 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 03 2009 12:00AM |
| Updated: | May 26 2011 08:21PM |
| Credit: | Salvatore "drosophila" Fresta |
| Vulnerable: |
Haudenschilt Family Connections 1.8.2 Haudenschilt Family Connections 1.8.1 Haudenschilt Family Connections 0.1.2 Haudenschilt Family Connections 0.1.1 Haudenschilt Family Connections 1.4 Haudenschilt Family Connections 0.9 Haudenschilt Family Connections 0.8 Haudenschilt Family Connections 0.6 Haudenschilt Family Connections 0.5 |
| Not Vulnerable: |
Haudenschilt Family Connections 2.3.2 |
Discussion
Family Connections 'fcms/upload.php' Arbitrary File Upload Vulnerability
Family Connections is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately validate user-supplied input.
An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.
Family Connections 1.8.2 is vulnerable; other versions may also be affected.
Family Connections is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately validate user-supplied input.
An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.
Family Connections 1.8.2 is vulnerable; other versions may also be affected.
Exploit / POC
Family Connections 'fcms/upload.php' Arbitrary File Upload Vulnerability
Attackers may exploit this issue through a browser.
The following exploit code is available:
Attackers may exploit this issue through a browser.
The following exploit code is available:
Solution / Fix
Family Connections 'fcms/upload.php' Arbitrary File Upload Vulnerability
Solution:
The vendor released an update. please see the reference for details.
Solution:
The vendor released an update. please see the reference for details.
References
Family Connections 'fcms/upload.php' Arbitrary File Upload Vulnerability
References:
References:
- Family Connections Homepage (Family Connections)
- Family Connections <= 1.8.2 - Remote Shell Upload Exploit ("Salvatore \"drosophila\" Fresta"
- Family Connections 1.8.2 Arbitrary File Upload ("Salvatore \"drosophila\" Fresta"