Hosting Controller saveuploadfiles.asp Arbitrary File Upload

2006-04-02T00:00:00
ID OSVDB:24772
Type osvdb
Reporter Paolo Difebbo(paolo.difebbo@gmail.com)
Modified 2006-04-02T00:00:00

Description

Vulnerability Description

Hosting Controller 2002 RC1 contains a flaw that may allow a remote attacker to upload files. The issue is due to saveuploadfiles.asp not verifying the value in the OpenPath variable. This may allow an attacker to upload or overwrite arbitrary files on the system.

Solution Description

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Short Description

Hosting Controller 2002 RC1 contains a flaw that may allow a remote attacker to upload files. The issue is due to saveuploadfiles.asp not verifying the value in the OpenPath variable. This may allow an attacker to upload or overwrite arbitrary files on the system.

References:

Vendor URL: http://hostingcontroller.com/ Related OSVDB ID: 24773 Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-04/0021.html ISS X-Force ID: 25675 CVE-2006-1621