Atomy Maxsite 'index.php' Arbitrary File Upload Vulnerability

Bugtraq ID:	60859
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 30 2013 12:00AM
Updated:	Jun 30 2013 12:00AM
Credit:	Iranian_Dark_Coders_Team
Vulnerable:	Atomy Maxsite Atomy Maxsite 2.5 Atomy Maxsite Atomy Maxsite 1.50
Not Vulnerable:

Atomy Maxsite 'index.php' Arbitrary File Upload Vulnerability

Atomy Maxsite is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this issue to upload arbitrary code and execute it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Atomy Maxsite versions 1.50 through 2.5 are vulnerable.

Atomy Maxsite 'index.php' Arbitrary File Upload Vulnerability

An attacker can exploit the issue using a browser.

The following example URI is available:

http://www.example.com/[path]/index.php?name=research&file=add&op=research_add

Atomy Maxsite 'index.php' Arbitrary File Upload Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Atomy Maxsite 'index.php' Arbitrary File Upload Vulnerability

References:

• Atomy Maxsite Homepage (Atomy Maxsite)