eLitius Arbitrary File Upload and Authentication Bypass Vulnerabilities

Bugtraq ID:	34813
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 04 2009 12:00AM
Updated:	May 05 2009 01:37AM
Credit:	G4NOK
Vulnerable:	Intelliants eLitius 1.0
Not Vulnerable:

eLitius Arbitrary File Upload and Authentication Bypass Vulnerabilities

eLitius is prone to a vulnerability that lets remote attackers upload and execute arbitrary code because it fails to properly sanitize user-supplied files. The application is also prone to an authentication-bypass vulnerability.

An attacker can leverage these issues to execute arbitrary code on an affected computer with the privileges of the webserver process or to perform administrative actions without proper authentication.

eLitius 1.0 is vulnerable; other versions may also be affected.

eLitius Arbitrary File Upload and Authentication Bypass Vulnerabilities

Attackers may exploit these issues with a browser.

The following exploit is available:

• /data/vulnerabilities/exploits/34813.php

eLitius Arbitrary File Upload and Authentication Bypass Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

eLitius Arbitrary File Upload and Authentication Bypass Vulnerabilities

References:

• eLitius Homepage (Intelliants)