Avaya IP Office Customer Call Reporter 'ImageUpload.ashx' Remote Code Execution Vulnerability

Bugtraq ID:	54225
Class:	Design Error
CVE:	CVE-2012-3811
Remote:	Yes
Local:	No
Published:	Jun 28 2012 12:00AM
Updated:	Oct 09 2012 09:20AM
Credit:	Andrea Micalizzi aka rgod
Vulnerable:
Not Vulnerable:

Avaya IP Office Customer Call Reporter 'ImageUpload.ashx' Remote Code Execution Vulnerability

Avaya IP Office Customer Call Reporter is prone to a remote code-execution vulnerability.

Attackers can leverage this issue to execute arbitrary code with the privileges of the user running the affected application.

Avaya IP Office Customer Call Reporter 7.0 and 8.0 are vulnerable; other versions may also be affected.

Avaya IP Office Customer Call Reporter 'ImageUpload.ashx' Remote Code Execution Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/54225.rb

Avaya IP Office Customer Call Reporter 'ImageUpload.ashx' Remote Code Execution Vulnerability

Solution:
Updates are available; please see the references for more information.

Avaya IP Office Customer Call Reporter 'ImageUpload.ashx' Remote Code Execution Vulnerability

References:

• Avaya Homepage (Avaya Inc.)