PT-2005-2838 · Yapig · Yapig

Published 2005-06-06 · Updated 2024-01-26 · CVE-2005-1881

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions YaPiG versions 0.92b through 0.94u

Description The issue concerns the upload.php file in YaPiG, which does not properly restrict the file extension for uploaded image files. This allows remote attackers to upload arbitrary files and execute arbitrary PHP code.

Recommendations For YaPiG versions 0.92b through 0.94u, consider restricting access to the upload.php file until a proper fix is applied, and ensure that only authorized users can upload files. As a temporary workaround, consider validating and restricting file extensions for uploaded image files to prevent the execution of arbitrary PHP code.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2005-1881

Affected Products

Yapig

References · 7

• 🔥 https://exploit-db.com/exploits/25792 · Exploit
• 🔥 http://securitytracker.com/id?1014103 · Exploit
• http://osvdb.org/17115 · Vendor Advisory
• http://secunia.com/advisories/15600 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-1881 · Security Note
• http://secwatch.org/advisories/secwatch/20050530_yapig.txt · Vendor Advisory
• https://t.me/cvenotify/68949 · Telegram Post