SocialEngine Music Sharing Plugin Arbitrary File Upload Vulnerability

Bugtraq ID:	45584
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 22 2010 12:00AM
Updated:	Dec 28 2010 02:33PM
Credit:	MyDoom
Vulnerable:	Social Engine Social Engine 4.0.4 Social Engine Social Engine 4.0
Not Vulnerable:	Social Engine Social Engine 4.0.5p2

SocialEngine Music Sharing Plugin Arbitrary File Upload Vulnerability

SocialEngine Music Sharing Plugin is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary PHP scripts and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

SocialEngine Music Sharing Plugin 4.0 is vulnerable; other versions may also be affected.

SocialEngine Music Sharing Plugin Arbitrary File Upload Vulnerability

Attackers can exploit this issue through a browser.

SocialEngine Music Sharing Plugin Arbitrary File Upload Vulnerability

Solution:
An update is available. Please see the references for more information.

SocialEngine Music Sharing Plugin Arbitrary File Upload Vulnerability

References:

• SocialEngine Homepage (Webligo Developments)
  
• SocialEngine Release notes (Webligo Developments)