PT-2003-2497 · Uploader · Uploader

Published 2003-12-31 · Updated 2018-10-19 · CVE-2003-1552

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Uploader version 1.1

Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the uploader.php script, and then accessing it via a direct request to the file in the uploads/ directory.

Recommendations For version 1.1, consider restricting the types of files that can be uploaded through the uploader.php script to prevent the execution of arbitrary code, or apply additional validation to ensure only authorized file types are uploaded. As a temporary workaround, consider disabling the uploader.php script until a more secure version is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2003-1552

Affected Products

Uploader

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2003-1552 · Security Note
• http://securityfocus.com/archive/1/313787/30/25670/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11467 · Note
• http://securityfocus.com/archive/1/313819/30/25640/threaded · Note