source: http://www.securityfocus.com/bid/28919/info The DownloadsPlus module for PHP-Nuke is prone to a vulnerability that lets remote attackers upload and execute arbitrary code because the application fails to sanitize user-supplied input. This issue permits attackers to upload arbitrary files with '.htm', '.html', or '.txt' extensions. An attacker can leverage this issue to execute arbitrary code on an affected computer with the privileges of the webserver process. Note that to exploit this issue, the attacker may require valid login credentials. http://www.example.com/phpnuke/upload_category/filename.html
Related Exploits
Trying to match CVEs (1): CVE-2008-4767Trying to match OSVDBs (1): 49409
Other Possible E-DB Search Terms: PHP-Nuke DownloadsPlus Module
Date | D | V | Title | Author | No matches |
---|