header-logo
Suggest Exploit
vendor:
PHP File Uploader
by:
Unknown
7.5
CVSS
HIGH
Arbitrary File Upload
434
CWE
Product Name: PHP File Uploader
Affected Version From: Unknown
Affected Version To: Unknown
Patch Exists: NO
Related CWE: Unknown
CPE: a:phpfileuploader:php_file_uploader
Metasploit:
Other Scripts:
Platforms Tested:
2010

Arbitrary File Upload in PHP File Uploader

The PHP File Uploader application fails to adequately limit the types of files that are uploaded. An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the webserver process, leading to unauthorized access, privilege escalation, or other attacks.

Mitigation:

To mitigate this vulnerability, ensure that the PHP File Uploader application properly validates and restricts the types of files that can be uploaded. Implement server-side checks and filters to verify the file type before allowing it to be uploaded.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/40159/info

PHP File Uploader is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to adequately limit the types of files that are uploaded.

An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks may also possible. 

http://www.example.com/PHPFileUploader/_uploads/ch99.php__2010-01-02_10.00am.php

Navigation

Suggest Exploit

Services By CQR