PHP Volunteer Management Arbitrary File Upload and HTML Injection Vulnerabilities

Bugtraq ID:	53701
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 28 2012 12:00AM
Updated:	May 31 2012 07:30AM
Credit:	Ashoo
Vulnerable:	Shawn Bradley PHP Volunteer Management 1.0.2
Not Vulnerable:

PHP Volunteer Management Arbitrary File Upload and HTML Injection Vulnerabilities

PHP Volunteer Management is prone to an arbitrary-file-upload vulnerability and an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

An attacker could exploit these vulnerabilities to execute arbitrary script code in a user's browser in the context of the affected site or execute arbitrary code on the server.

PHP Volunteer Management 1.0.2 is vulnerable; other versions may also be affected.

PHP Volunteer Management Arbitrary File Upload and HTML Injection Vulnerabilities

An attacker can exploit these issues through a browser.

The following exploit is available:

• /data/vulnerabilities/exploits/53701.rb

PHP Volunteer Management Arbitrary File Upload and HTML Injection Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

PHP Volunteer Management Arbitrary File Upload and HTML Injection Vulnerabilities

References:

• PHP Volunteer Management Homepage (Shawn Bradley)