Ajax Upload Arbitrary File Upload

vendor:

Ajax Upload

by:

Daniel Godoy

N/A

CVSS

N/A

Arbitrary File Upload

N/A

CWE

Product Name: Ajax Upload

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2012

Ajax Upload Arbitrary File Upload

You can upload any file you want by bypasss extesion wing headers, if you use mozilla firefox live http headers can be used for modification of the same. or naming the file but also for example as shell.php.php.php.jpg.zip

Mitigation:

N/A

Source

Exploit-DB raw data:

# Exploit Title: Ajax Upload Arbitrary File Upload
# Date: 30/01/2012
# Author: Daniel Godoy
# Author Mail: DanielGodoy[at]GobiernoFederal[dot]com
# Author Web: www.delincuentedigital.com.ar
# Software: Ajax Upload
# http://valums.com/ajax-upload/
# Tested on: Linux
  
[Comment]
Agradezco a mis amigos: Hernan Jais, Alfonso Cuevas, Lisandro
Lezaeta, Inyexion, Login-Root, KikoArg, Ricota, Truenex, _tty0, Big,
Sunplace,Erick Jordan,Animacco ,yojota, Pablin77, SPEED, Knet,
Cereal, Yago, Rash, MagnoBalt, El Rodrix,NetT0xic,Gusan0r,Lucas Apa,
Maxi Soler, Darioxchx,r0dr1,Zer0-Zo0rg
  
  
[Arbitrary File Upload]

You can upload any file you want by bypasss extesion wing headers, if
you use mozilla firefox live http headers can be used for modification
of the same.
or naming the file but also for example as shell.php.php.php.jpg.zip

-------------------------
Correo enviado por medio de MailMonstruo - www.mailmonstruo.com