vendor:
VideoIsland
by:
RENO
7.5
CVSS
HIGH
Remote shell upload
434
CWE
Product Name: VideoIsland
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
VideoIsland Remote shell upload Vulnerability
VideoIsland is vulnerable to a remote shell upload vulnerability. An attacker can upload a malicious PHP shell to the server by exploiting the File Uploader feature in the VideoManager section of the application. The malicious file can be accessed at http://localhost/Path/Storage/reno.php
Mitigation:
Ensure that the application is configured to only allow the upload of files with the appropriate file extensions and that the application is configured to only allow the upload of files to a directory outside of the web root.
