exploit-db-mirror/exploits/php/webapps/21921.txt
Offensive Security d304cc3d3e DB: 2017-11-24
116602 new exploits

Too many to list!
2017-11-24 20:56:23 +00:00

10 lines
No EOL
820 B
Text

source: http://www.securityfocus.com/bid/5926/info
It has been reported that VBZoom 1.01 may allow attackers to upload arbitrary files to a vulnerable system.
The vulnerability is the result of VBZoom failing to properly validate the types of files that are received. Validation is done through the use of JavaScript on the client side. An attacker can exploit this vulnerability by specifying an arbitrary file to be uploaded.
Given the ability to upload arbitrary files to the host, an attacker can exploit this vulnerability to upload malicious PHP scripts to the vulnerable system. Any malicious PHP files referenced will be executed in the security context of the site hosting VBZoom.
http://www.victim.com/VBZooM/add-subject.php?Success=1
&FileName=SourceFile&FileName_size=500&FileName_name=DistFile