PT-2005-2838 · Yapig · Yapig

CVE-2005-1881 · Publicado 2005-06-06 · Atualizado 2024-01-26

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions YaPiG versions 0.92b through 0.94u

Description The issue concerns the upload.php file in YaPiG, which does not properly restrict the file extension for uploaded image files. This allows remote attackers to upload arbitrary files and execute arbitrary PHP code.

Recommendations For YaPiG versions 0.92b through 0.94u, consider restricting access to the upload.php file until a proper fix is applied, and ensure that only authorized users can upload files. As a temporary workaround, consider validating and restricting file extensions for uploaded image files to prevent the execution of arbitrary PHP code.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2005-1881

Produtos afetados

Yapig

Referências · 7

• 🔥 https://exploit-db.com/exploits/25792 · Exploit
• 🔥 http://securitytracker.com/id?1014103 · Exploit
• http://osvdb.org/17115 · Aviso do Fabricante
• http://secunia.com/advisories/15600 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-1881 · Nota de Segurança
• http://secwatch.org/advisories/secwatch/20050530_yapig.txt · Aviso do Fabricante
• https://t.me/cvenotify/68949 · Publicação no Telegram