PT-2003-2497 · Uploader · Uploader

Publicado 2003-12-31 · Atualizado 2018-10-19 · CVE-2003-1552

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Uploader version 1.1

Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the uploader.php script, and then accessing it via a direct request to the file in the uploads/ directory.

Recommendations For version 1.1, consider restricting the types of files that can be uploaded through the uploader.php script to prevent the execution of arbitrary code, or apply additional validation to ensure only authorized file types are uploaded. As a temporary workaround, consider disabling the uploader.php script until a more secure version is available.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2003-1552

Produtos afetados

Uploader

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2003-1552 · Nota de Segurança
• http://securityfocus.com/archive/1/313787/30/25670/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11467 · Nota
• http://securityfocus.com/archive/1/313819/30/25640/threaded · Nota