vendor:
YUI Images Script
by:
Mr.P3rfekT
N/A
CVSS
N/A
Shell Upload
N/A
CWE
Product Name: YUI Images Script
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: N/A
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Linux
N/A
YUI Images Script Shell Upload Vulnerability
YUI Images Script is vulnerable to shell upload. An attacker can upload a malicious file with a .php.giff extension to the server. The malicious file can be accessed at http://127.0.0.1/YUI-upload/html/files/
Mitigation:
The application should be configured to only allow the upload of files with the appropriate extensions and should also be configured to reject files with multiple extensions.
