Tutos 1.1 - File_New Arbitrary File Upload



EKU-ID: 28290 CVE: CVE-2003-0482;OSVDB-10163 OSVDB-ID:
Author: François SORIN Published: 2003-06-20 Verified: Verified
Download:

Rating

☆☆☆☆☆
Home 


source: https://www.securityfocus.com/bid/8012/info

It has been reported that Tutos does not properly handle input to the file_new script. Because of this, an attacker may be able to upload arbitrary files to a vulnerable site.

We can upload via http://www.example.com/tutos/file/file_new.php?link_id=1065

The path is http://www.example.com/tutos/repository/[project number]/[file
number]/FILE