PT-2005-3506 · Ezupload · Eupload

Published 2005-08-17 · Updated 2011-03-08 · CVE-2005-2616

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ezUpload version 2.2

Description The issue allows remote attackers to execute arbitrary code via the path parameter to several PHP files, including "initialize.php", "customize.php", "form.php", and "index.php".

Recommendations For ezUpload version 2.2, consider restricting access to the vulnerable PHP files until a patch is available. As a temporary workaround, avoid using the path parameter in the affected files.

Exploit

Fix

Related Identifiers

CVE-2005-2616

Affected Products

Eupload

References · 11

• 🔥 http://securityfocus.com/bid/14534 · Exploit
• 🔥 https://exploit-db.com/exploits/26140 · Exploit
• 🔥 https://exploit-db.com/exploits/26143 · Exploit
• 🔥 https://exploit-db.com/exploits/26142 · Exploit
• 🔥 http://securiteam.com/exploits/5JP0J15GKU.html · Exploit
• 🔥 https://exploit-db.com/exploits/26141 · Exploit
• 🔥 http://packetstorm.linuxsecurity.com/0508-exploits/ezuploadRemote.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-2616 · Security Note
• http://secunia.com/advisories/16434 · Vendor Advisory
• http://vupen.com/english/advisories/2005/1379 · Note
• http://securitytracker.com/id?1014723 · Note