File Lite and File Pro Multiple Security Vulnerabilities

Bugtraq ID:	59819
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 04 2013 12:00AM
Updated:	May 04 2013 12:00AM
Credit:	Benjamin Kunz Mejri
Vulnerable:	Perception System File Pro 3.5 Perception System File Lite 3.3
Not Vulnerable:

File Lite and File Pro Multiple Security Vulnerabilities

File Lite and File Pro are prone to multiple security vulnerabilities, including:

1. An arbitrary-file-upload vulnerability

2. A cross-site scripting vulnerability

3. An HTML injection vulnerability

An attacker can exploit these issues to upload arbitrary files onto the web server, execute HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

File Lite and File Pro Multiple Security Vulnerabilities

An attacker can exploit these issues through a browser. To exploit a cross-site scripting issue the attacker must entice an unsuspecting user into following a malicious URI.

The following example data is available:

• /data/vulnerabilities/exploits/59819.txt

File Lite and File Pro Multiple Security Vulnerabilities

References:

• File Lite 3.3 & 3.5 PRO iOS - Multiple Web Vulnerabilities (Vulnerability Lab)
  
• File Lite Homepage (Perception System)
  
• File Pro Homepage (Perception System)