NAS Uploader [V1.0&1.5] Remote File Upload Vulnerability

vendor:

NAS Uploader

by:

ViRuSMaN

8.8

CVSS

HIGH

Remote File Upload

434

CWE

Product Name: NAS Uploader

Affected Version From: 1

Affected Version To: 1.5

Patch Exists: Yes

Related CWE: N/A

CPE: a:nasuploader:nas_uploader

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

NAS Uploader [V1.0&1.5] Remote File Upload Vulnerability

A vulnerability exists in NAS Uploader versions 1.0 and 1.5, which allows an attacker to upload a malicious file to the server. The attacker can go to the target website's upload_multiple_js.php page, click on the 'Parcourir' button, and upload a shell file in the form of 'shell.php.rar'. The uploaded file can then be accessed at target.com/[path]/uploads/tests/shell.php.rar.

Mitigation:

The vendor has released a patch to address this vulnerability. Users should update to the latest version of NAS Uploader.

Source

Exploit-DB raw data:

##############################################################
|
| NAS Uploader [V1.0&1.5] Remote File Upload Vulnerability
|
| Author : [ViRuSMaN]
|
| Contact : [v.-m@live.com]
|
| Home : [Islam-Attack.CoM , HackTeach.OrG]
|
| Download : [http://www.nasuploader.com/nasuploader_v10_packdemo.php]
| [http://www.nasuploader.com/nasuploader_v15_packdemo.php]
|
##############################################################
|
|
| Exp :
|
| 1- Go to target.com/[path]/upload_multiple_js.php
|
| 2- Click On "Parcourir"
|
| 3- Upload Your Shell Format "shell.php.rar"
|
| 4- Pwd Your Shell [target.com/[path]/uploads/tests/shell.php.rar]
|
##############################################################
|
| Greets : All members of islam-attack.com , hackteach.org & Sec-Sni.Com All Muslim's
|
##############################################################