Joe Lumbroso Jack's Formmail.php Unauthorized Remote File Upload Vulnerability
BID:9591
Info
Joe Lumbroso Jack's Formmail.php Unauthorized Remote File Upload Vulnerability
| Bugtraq ID: | 9591 |
| Class: | Origin Validation Error |
| CVE: |
CVE-2004-0259 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 06 2004 12:00AM |
| Updated: | Jul 12 2009 02:06AM |
| Credit: | The disclosure of this issue has been credited to Himeur Nourredine <[email protected]>. |
| Vulnerable: |
Joe Lumbroso Jack's FormMail.php 5.0 Joe Lumbroso Jack's FormMail.php 2.0 |
| Not Vulnerable: | |
Discussion
Joe Lumbroso Jack's Formmail.php Unauthorized Remote File Upload Vulnerability
It has been reported that Jack's Formmail.php may be prone to an unauthorized file upload vulnerability that may allow a remote attacker to gain unauthorized access to a vulnerable server and upload arbitrary files. Due to improper validation performed in the 'check_referer()' function, an attacker can bypass the checks by supplying an empty value for HTTP referer. This issue may then allow an attacker to upload a file via the 'css' variable of 'file.php' script.
Although unconfirmed, Formmail.php versions 5.0 and prior may be affected by this issue.
It has been reported that Jack's Formmail.php may be prone to an unauthorized file upload vulnerability that may allow a remote attacker to gain unauthorized access to a vulnerable server and upload arbitrary files. Due to improper validation performed in the 'check_referer()' function, an attacker can bypass the checks by supplying an empty value for HTTP referer. This issue may then allow an attacker to upload a file via the 'css' variable of 'file.php' script.
Although unconfirmed, Formmail.php versions 5.0 and prior may be affected by this issue.
Exploit / POC
Joe Lumbroso Jack's Formmail.php Unauthorized Remote File Upload Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
References
Joe Lumbroso Jack's Formmail.php Unauthorized Remote File Upload Vulnerability
References:
References:
- Jacks FormMail.php (Joe Lumbroso)
- formmail (PHP) Upload file using CSS (Himeur Nourredine