vendor:
PHP Store Auto Classifieds
by:
ZoRLu
7.5
CVSS
HIGH
Remote File Upload
434
CWE
Product Name: PHP Store Auto Classifieds
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
PHP Store Auto Classifieds Remote File Upload
A vulnerability exists in PHP Store Auto Classifieds which allows an attacker to upload a malicious file to the server. An attacker can register to the site and add a malicious code to the head of a shell file. The attacker can then login to the site and edit their profile to upload the shell file. The shell file will be uploaded to the server at a path such as localhost/script/cars_images/[ID]_logo_your_shell.php
Mitigation:
Ensure that user input is properly sanitized and validated before being used in a file upload operation.
