Talkie Bluetooth Video iFiles Multiple Security Vulnerabilities

Bugtraq ID:	62314
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 30 2013 12:00AM
Updated:	Aug 30 2013 12:00AM
Credit:	Benjamin Kunz Mejri
Vulnerable:	yulan zhao Talkie Bluetooth Video iFiles 2.0
Not Vulnerable:

Talkie Bluetooth Video iFiles Multiple Security Vulnerabilities

Talkie Bluetooth Video iFiles is prone to multiple security vulnerabilities because it fails to adequately validate files before uploading them.

An attacker can exploit these issues to execute HTML or JavaScript code in the context of the affected site, cause denial of service conditions, upload arbitrary files onto the web server or execute arbitrary local files within the context of the web server. This may help the attacker steal cookie-based authentication credentials, obtain sensitive information or crash the application.

Talkie Bluetooth Video iFiles 2.0 is vulnerable; other versions may also be affected.

Talkie Bluetooth Video iFiles Multiple Security Vulnerabilities

An attacker can exploit these issues using a web browser.

The researcher has created a proof-of-concept to demonstrate these issues. Please see the references for more information.

Talkie Bluetooth Video iFiles Multiple Security Vulnerabilities

References:

• Talkie Bluetooth Video iFiles 2.0 iOS - Multiple Vulnerabilities (Vulnerability Lab)
  
• Talkie Bluetooth Video iFiles iTunes Page (yulan zhao)