vendor:
Real Estate
by:
ZoRLu
7.5
CVSS
HIGH
Remote File Upload
434
CWE
Product Name: Real Estate
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
PHP Store Real Estate Remote File Upload
A vulnerability exists in PHP Store Real Estate, which allows an attacker to upload a malicious file to the server. An attacker can register to the site and add a malicious code to the head of a shell file. The attacker can then login to the site and edit their profile, uploading the malicious shell file. The shell file will be stored in the localhost/script/re_images/[ID]_logo_your_shell.php path.
Mitigation:
Ensure that user input is properly validated and sanitized before being used in a file upload operation.
