VBZoom 1.0 - Arbitrary File Upload

source: https://www.securityfocus.com/bid/5926/info

It has been reported that VBZoom 1.01 may allow attackers to upload arbitrary files to a vulnerable system.

The vulnerability is the result of VBZoom failing to properly validate the types of files that are received. Validation is done through the use of JavaScript on the client side. An attacker can exploit this vulnerability by specifying an arbitrary file to be uploaded. 

Given the ability to upload arbitrary files to the host, an attacker can exploit this vulnerability to upload malicious PHP scripts to the vulnerable system. Any malicious PHP files referenced will be executed in the security context of the site hosting VBZoom.

http://www.victim.com/VBZooM/add-subject.php?Success=1
&FileName=SourceFile&FileName_size=500&FileName_name=DistFile