8 lines
No EOL
396 B
Text
8 lines
No EOL
396 B
Text
source: https://www.securityfocus.com/bid/8012/info
|
|
|
|
It has been reported that Tutos does not properly handle input to the file_new script. Because of this, an attacker may be able to upload arbitrary files to a vulnerable site.
|
|
|
|
We can upload via http://www.example.com/tutos/file/file_new.php?link_id=1065
|
|
|
|
The path is http://www.example.com/tutos/repository/[project number]/[file
|
|
number]/FILE |