vendor:
Complete Customizable Classifieds
by:
ZoRLu
N/A
CVSS
N/A
Remote File Upload
CWE
Product Name: Complete Customizable Classifieds
Affected Version From:
Affected Version To:
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested: Unknown
2008
PHPStore Complete Customizable Classifieds Remote File Upload
The PHPStore Complete Customizable Classifieds application allows remote file upload, which can be exploited to upload malicious PHP files and gain unauthorized access to the server. An attacker can register on the site, add a malicious PHP code to the shell, and upload it as a logo. The uploaded shell can then be accessed at the path localhost/script/yellow_images/[ID]_logo_your_shell.php.
Mitigation:
It is recommended to apply a patch or update to a newer version of the PHPStore Complete Customizable Classifieds application that fixes the remote file upload vulnerability. Additionally, access controls and file upload validation should be implemented to prevent unauthorized file uploads.
