PT-2009-2108 · Versalsoft · Versalsoft Http Image Uploader

Published 2009-04-07 · Updated 2017-09-29 · CVE-2008-6638

Positive Technologies (AI Summary)

CVSS v2.0

8.8

High

Base vector

AV:N/AC:M/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Versalsoft HTTP Image Uploader version 6.0.0.35

Description The issue concerns an insecure method in the Versalsoft HTTP Image Uploader ActiveX control, which allows remote attackers to delete arbitrary files. This is achieved via the RemoveFileOrDir method.

Recommendations For version 6.0.0.35, consider disabling the RemoveFileOrDir method until a patch is available to prevent the deletion of arbitrary files.

Exploit

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2008-6638

Affected Products

Versalsoft Http Image Uploader

References · 5

• 🔥 https://exploit-db.com/exploits/5569 · Exploit
• 🔥 https://exploit-db.com/exploits/5272 · Exploit
• 🔥 http://securityfocus.com/bid/28301 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6638 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41258 · Note