bigdump-upload.txt

`============================================================  
!vuln  
BigDump ver. 0.29b  
Previous versions may also be affected.  
============================================================  
  
============================================================  
!risk  
Medium  
There are currently many websites circulating with BigDump  
enabled.  
============================================================  
  
============================================================  
!dork  
Dork: intitle:"BigDump ver. 0.29b"  
============================================================  
  
============================================================  
!discussion  
A user is able to successfully upload files onto a server by  
uploading a php shell such as c99.php, by renaming it   
c99.php.sql  
============================================================  
  
============================================================  
!solution  
Do not use BigDump or put non-root/guest permissions on the  
folder containing BigDump. The vendor has not yet been   
notified.  
============================================================  
  
============================================================  
!greetz  
Greetz go out to the people who know me.  
============================================================  
  
============================================================  
!author  
Xia Shing Zee  
============================================================  
`