SpagoBI CVE-2013-6234 Arbitrary File Upload Vulnerability

Bugtraq ID:	65488
Class:	Input Validation Error
CVE:	CVE-2013-6234
Remote:	Yes
Local:	No
Published:	Mar 01 2014 12:00AM
Updated:	Mar 01 2014 12:00AM
Credit:	Christian Catalano
Vulnerable:	Engineering Ingegneria Informatica S.p.A. SpagoBI 4.0
Not Vulnerable:	Engineering Ingegneria Informatica S.p.A. SpagoBI 4.1

SpagoBI CVE-2013-6234 Arbitrary File Upload Vulnerability

SpagoBI is prone to an arbitrary-file-upload vulnerability because it fails to adequately sanitize user-supplied input.

An attacker may leverage this issue to upload arbitrary files; this can result in arbitrary code execution within the context of the vulnerable application.

SpagoBI 4.0 is vulnerable; other versions may also be affected.

SpagoBI CVE-2013-6234 Arbitrary File Upload Vulnerability

An attacker can exploit this issue using browser or readily available tools.

Following exploit code is available:

• /data/vulnerabilities/exploits/65488.html.txt

SpagoBI CVE-2013-6234 Arbitrary File Upload Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

SpagoBI CVE-2013-6234 Arbitrary File Upload Vulnerability

References:

• [CVE-2013-6234] XSS File Upload in SpagoBI v4.0 (Christian Catalano)
  
• SpagoBI Homepage (Engineering Ingegneria Informatica S.p.A.)