vendor:
PHP RapidKill Pro
by:
DigitALL
7,5
CVSS
HIGH
Shell Upload
434
CWE
Product Name: PHP RapidKill Pro
Affected Version From: 5.x
Affected Version To: 5.x
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2010
PHP RapidKill Pro 5.x Shell Upload Vulnerability
A vulnerability exists in PHP RapidKill Pro 5.x which allows an attacker to upload a malicious shell file (r57 or DigitALL Shell) to the vulnerable server. The attacker can then access the shell by clicking on the 'FİLES' option and renaming the file to xx.php. After clicking the 'Go To Shell' option, the attacker can gain access to the vulnerable server.
Mitigation:
Ensure that the web server is configured to only allow the upload of legitimate files and that all uploaded files are scanned for malicious content.
