Exploit FOSS Gallery Public 1.0 - Arbitrary File Upload (PoC)

[Exploiter]

EDB-ID

6680

Проверка EDB

1. Пройдено

Автор

PEPELUX

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2008-4509

Дата публикации

2008-10-05

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
FOSS Gallery Public Version <= 1.0 / Arbitrary file upload Vulnerabilities
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Program: FOSS Gallery Public Version
Version: <= 1.0
File affected: processFiles.php
Download: http://sourceforge.net/projects/fossgallery/


Found by Pepelux <pepelux[at]enye-sec.org>
eNYe-Sec - www.enye-sec.org

-- Bug --
Website doesn't check the images format and you can upload PHP files.

-- Exploit --
http://localhost/shell.php

# milw0rm.com [2008-10-05]