osCMax Arbitrary File Upload and Full Path Information Disclosure Vulnerabilities

Bugtraq ID:	64307
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 09 2013 12:00AM
Updated:	Dec 09 2013 12:00AM
Credit:	KedAns-Dz
Vulnerable:	osCMax osCMax 2.5.3
Not Vulnerable:

osCMax Arbitrary File Upload and Full Path Information Disclosure Vulnerabilities

osCMax is prone to an arbitrary file-upload vulnerability and an information-disclosure vulnerability .

Attackers can exploit these issues to obtain sensitive information and upload arbitrary files. This may aid in other attacks.

osCMax 2.5.3 is vulnerable; other versions may also be affected.

osCMax Arbitrary File Upload and Full Path Information Disclosure Vulnerabilities

An attacker can exploit these issues using a web browser.

The following example data and URI are available:

http://www.example.com/oxmax/ext/phpthumb/demo/phpThumb.demo.object.php

• /data/vulnerabilities/exploits/64307.php.txt

osCMax Arbitrary File Upload and Full Path Information Disclosure Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

osCMax Arbitrary File Upload and Full Path Information Disclosure Vulnerabilities

References:

• osCMax Homepage (osCMax)