NEPT Image Uploader 1.0 Arbitrary Shell Upload Vulnerability

ID SSV:9799
Type seebug
Reporter Root
Modified 2008-10-25T00:00:00


No description provided by source.

                                                //Title - NEPT Image Uploader shell upload

//Vendor -

//Version - 1.0

//Status - vendor has been notified

//Author - Dentrasi


It is possible to upload a php script to the remote site.

1. Select a php file for upload
2. Select it for upload, and tamperdata the request
3. Change the Content-Type from 'application/octet-stream' to 'image/jpeg'
4. If the link provided gives a 404, add 'upload/' before the file name