FileExecutive Multiple Remote Vulnerabilities

Bugtraq ID:	38433
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 26 2010 12:00AM
Updated:	Feb 26 2010 12:00AM
Credit:	ViRuSMaN
Vulnerable:	FileExecutive FileExecutive 1.0
Not Vulnerable:

FileExecutive Multiple Remote Vulnerabilities

FileExecutive is prone to multiple remote vulnerabilities:

- A cross-site request-forgery vulnerability
- An arbitrary-file-upload vulnerability
- An arbitrary-file-disclosure vulnerability
- A path-disclosure vulnerability

An attacker can exploit these issues to obtain sensitive information, perform certain administrative actions, upload arbitrary files, and execute arbitrary code within the context of the affected webserver application.

FileExecutive 1.0.0 is vulnerable; other versions may also be affected.

FileExecutive Multiple Remote Vulnerabilities

Attackers may exploit these issues through a browser.

The following example URI and exploit are available:

• /data/vulnerabilities/exploits/38443.txt

FileExecutive Multiple Remote Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

FileExecutive Multiple Remote Vulnerabilities

References:

• FileExecutive Sourceforge Page (FileExecutive)