vendor:
MultiPowUpload
by:
DIES3L
7.5
CVSS
HIGH
Remote File Upload
434
CWE
Product Name: MultiPowUpload
Affected Version From: 2.1
Affected Version To: 2.1
Patch Exists: NO
Related CWE: N/A
CPE: a:element-it:multipowupload:2.1
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Linux
2011
MultiPowUpload v 2.1 Remote File Upload Vulnerability
A vulnerability exists in MultiPowUpload v 2.1 which allows an attacker to upload a malicious file to the server. By clicking the 'Browse' button and selecting a malicious file, the attacker can upload the file to the server. The malicious file can then be accessed at http://localhost/[path]/FileProcessingScripts/PHP/UploadedFiles/[SHELL.php].
Mitigation:
Ensure that the application is configured to only allow the upload of files with specific extensions and that the application is configured to reject files with executable content.
