# MHG Security Team --- OzzyWork Gallery Upload Vulnerabilities

2006-05-10T00:00:00
ID SECURITYVULNS:DOC:12625
Type securityvulns
Reporter Securityvulns
Modified 2006-05-10T00:00:00

Description

Milli-Harekat Advisory ( www.milli-harekat.org )

OzzyWork Gallery Upload Vulnerabilities

Risk : High

Class: Remote

Script : OzzyWork Gallery All Version

Credits : Dj ReMix

Thanks : ßy Korsan , ESKOBAR , Poizonb0x , TR_IP

OzzyWork Gallery pictures upload page : www.victim.com/[Ozzywork Path ]/add.asp

Vulnerable Code : onSubmit="checkFileUpload(this,'GIF,JPG,JPEG,BMP,PNG',true,'',150,100,640,480,'PIC_WIDTH','PIC_HEIGHT');return document.MM_returnValue

This Code Deleted and All file Type upload...