admin
08-30-2005, 12:58 PM
FUDforum
http://fudforum.org
August 30th, 2005
http://secunia.com/advisories/16627/
Description:
riklaunim has discovered a vulnerability in FUDforum, which can be exploited by malicious people to compromise a vulnerable system.
The vulnerability is caused due to missing restrictions on the types of files that users are allowed to upload as customised avatar images. This can be exploited to upload malicious script files (e.g. PHP scripts) inside the web root.
Successful exploitation requires that users are allowed to add customised avatars (in the default settings the administrator has to approve new avatars).
The vulnerability has been confirmed in version 2.6.15. Prior versions may also be affected.
Solution:
Update to version 2.7.1.
http://fudforum.org/download.php
Do not allow users to add customised avatars.
Provided and/or discovered by:
riklaunim
http://fudforum.org
August 30th, 2005
http://secunia.com/advisories/16627/
Description:
riklaunim has discovered a vulnerability in FUDforum, which can be exploited by malicious people to compromise a vulnerable system.
The vulnerability is caused due to missing restrictions on the types of files that users are allowed to upload as customised avatar images. This can be exploited to upload malicious script files (e.g. PHP scripts) inside the web root.
Successful exploitation requires that users are allowed to add customised avatars (in the default settings the administrator has to approve new avatars).
The vulnerability has been confirmed in version 2.6.15. Prior versions may also be affected.
Solution:
Update to version 2.7.1.
http://fudforum.org/download.php
Do not allow users to add customised avatars.
Provided and/or discovered by:
riklaunim