ReVou Twitter Clone Arbitrary File Upload Vulnerability

vendor:

ReVou Twitter Clone

by:

S.W.A.T.

7.5

CVSS

HIGH

Arbitrary File Upload Vulnerability

434

CWE

Product Name: ReVou Twitter Clone

Affected Version From: All versions

Affected Version To: All versions

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

ReVou Twitter Clone Arbitrary File Upload Vulnerability

A vulnerability exists in ReVou Twitter Clone which allows an attacker to upload arbitrary files on the server. An attacker can create a file called name.php and fill it with malicious code and upload it to the server. This can be done by going to the “My photo” page and selecting the shell and uploading it.

Mitigation:

The vendor should ensure that the file types are properly validated before allowing them to be uploaded.

Source

Exploit-DB raw data:

#########################################################
---------------------------------------------------------
Portal Name: ReVou Twitter Clone Arbitrary File Upload Vulnerability
Version: All version
Vendor : http://www.revou.com/
Demo: http://www.revou.com/demo/
Author : S.W.A.T. , svvateam@yahoo.com
Vulnerability : wWw.BaTLaGH.CoM
---------------------------------------------------------
#########################################################
[Mime Check Bypass]:
Create A File Called name.php And Fill It As Below:
----------
GIF89aP;
[php_shell_code]
----------
Save This File !
----------
Go To "My photo" (link: http://www.revou.com/demo/settings/my_photo)

Select Your Shell & Upload !
----------
Done ! :-)
---------------------------------

# milw0rm.com [2008-12-21]