VBZoom 1.0 - Arbitrary File Upload Vulnerability

2002-10-09T00:00:00
ID EDB-ID:21921
Type exploitdb
Reporter hish
Modified 2002-10-09T00:00:00

Description

VBZoom 1.0 Arbitrary File Upload Vulnerability. Webapps exploit for php platform

                                        
                                            source: http://www.securityfocus.com/bid/5926/info

It has been reported that VBZoom 1.01 may allow attackers to upload arbitrary files to a vulnerable system.

The vulnerability is the result of VBZoom failing to properly validate the types of files that are received. Validation is done through the use of JavaScript on the client side. An attacker can exploit this vulnerability by specifying an arbitrary file to be uploaded. 

Given the ability to upload arbitrary files to the host, an attacker can exploit this vulnerability to upload malicious PHP scripts to the vulnerable system. Any malicious PHP files referenced will be executed in the security context of the site hosting VBZoom.

http://www.victim.com/VBZooM/add-subject.php?Success=1
&FileName=SourceFile&FileName_size=500&FileName_name=DistFile