vendor:
Max's File Uploader
by:
S2K9
9,3
CVSS
HIGH
Remote File Upload
434
CWE
Product Name: Max's File Uploader
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows XP SP2
2010
Max’s File Uploader
Max's File Uploader is vulnerable to a remote file upload vulnerability. An attacker can upload a malicious file to the server, which can be used to gain access to the server. The attacker can use the Dork to find the vulnerable website and then use the exploit to upload a malicious file to the server. The malicious file can then be accessed via the path maxFileUpload/shell.php.
Mitigation:
The website should have proper authentication and authorization mechanisms in place to prevent unauthorized file uploads. The website should also have a file type validation mechanism to prevent malicious files from being uploaded.
