EUVD-2008-2825

Malware in sbrugna...

Unrestricted file upload

Unrestricted file upload vulnerability in calendaradmin.asp in Full Revolution aspWebCalendar 2008 allows remote attackers to upload and execute arbitrary code via the FILE1 parameter in an uploadfileprocess action, probably followed by a direct request to the file in calendar/eventimages/...

AspWebCalendar 2008 - Arbitrary File Upload

Title:AspWebCalendar 2008 Remote File Upload Vulnerability Discovered by : AleminKrali Dork :calendar.asp?eventdetail http://site.com/path/calendaradmin.asp?action=uploadfile == upload your Asp shell http://site.com/path/calendar/eventimages/yourshell.asp == your address upload form...