VBZoom 1.01 Arbitrary File Upload Vulnerability

vendor:

VBZoom

by:

SecurityFocus

7.5

CVSS

HIGH

Arbitrary File Upload

434

CWE

Product Name: VBZoom

Affected Version From: 01.01

Affected Version To: 01.01

Patch Exists: N/A

Related CWE: N/A

CPE: a:vbzoom:vbzoom:1.01

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2002

VBZoom 1.01 Arbitrary File Upload Vulnerability

VBZoom 1.01 fails to properly validate the types of files that are received. An attacker can exploit this vulnerability by specifying an arbitrary file to be uploaded. This can be used to upload malicious PHP scripts to the vulnerable system, which will be executed in the security context of the site hosting VBZoom.

Mitigation:

Validate the types of files that are received.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/5926/info

It has been reported that VBZoom 1.01 may allow attackers to upload arbitrary files to a vulnerable system.

The vulnerability is the result of VBZoom failing to properly validate the types of files that are received. Validation is done through the use of JavaScript on the client side. An attacker can exploit this vulnerability by specifying an arbitrary file to be uploaded. 

Given the ability to upload arbitrary files to the host, an attacker can exploit this vulnerability to upload malicious PHP scripts to the vulnerable system. Any malicious PHP files referenced will be executed in the security context of the site hosting VBZoom.

http://www.victim.com/VBZooM/add-subject.php?Success=1
&FileName=SourceFile&FileName_size=500&FileName_name=DistFile