gleamtech filevista/fileultimate 4.6 – Directory Traversal

• Exploit Database
• 104 阅读

• 作者： Soroush Dalili
  日期： 2012-11-28
• 类别：

  • webapps
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/22972/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

  Hello I have recently released this vulnerability in a talk: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/     - Title: GleamtechFileVista/FileUltimate 4.6 Directory Traversal can lead to file upload attack - Credit goes to: Soroush Dalili - Link:http://www.gleamtech.com/download - Description: It is possible to bypass directory traversal validation of FileVista/FileUltimate version 4.3 by using "..[SPACE]/" or "..[SPACE]\". As a result, it can be possible to bypass the security restrictions and upload an arbitrary file and execute that on the server.   - PoC:http://www.youtube.com/v/HjS6Pob5t34?version=3&hl=en_US&rel=0&vq=hd720   Regards Soroush Dalili