----------------------------------------------------------------------

To improve our services to our customers, we have made a number of
additions to the Secunia Advisories and have started translating the
advisories to German.

The improvements will help our customers to get a better
understanding of how we reached our conclusions, how it was rated,
our thoughts on exploitation, attack vectors, and scenarios.

This includes:
* Reason for rating
* Extended description
* Extended solution
* Exploit code or links to exploit code
* Deep links

Read the full description:
http://corporate.secunia.com/products/48/?r=l

Contact Secunia Sales for more information:
http://corporate.secunia.com/how_to_buy/15/?r=l

----------------------------------------------------------------------

TITLE:
PHP Upload Tool File Upload And Directory Traversal

SECUNIA ADVISORY ID:
SA22973

VERIFY ADVISORY:
http://secunia.com/advisories/22973/

CRITICAL:
Moderately critical

IMPACT:
Exposure of system information, Exposure of sensitive information,
System access

WHERE:
>From remote

SOFTWARE:
PHP Upload Tool 1.x
http://secunia.com/product/12655/

DESCRIPTION:
Some vulnerabilities have been discovered in PHP Upload Tool, which
can be exploited by malicious users to gain system access or by
malicious people to expose sensitive information.

1) The bin/main_user.php script fails to validate the extension of an
uploaded file. This can be exploited to upload files with arbitrary
extensions (e.g. ".php") and execute arbitrary PHP code on the
server.

Successful exploitation requires valid user credentials.

2) Input passed to the "filename" parameter in bin/download.php is
not properly sanitised before being used to download files.

Successful exploitation allows for downloading of arbitrary files on
the system, e.g. "/etc/passwd" or "conf/users.conf" (the product's
usernames and password hashes).

The vulnerabilities are confirmed in version 1.0. Other versions may
also be affected.

SOLUTION:
Edit the source code to ensure that input is properly verified and
sanitised.

Restrict access to the application, e.g. with an ".htaccess" file.

PROVIDED AND/OR DISCOVERED BY:
Craig Heffner and an anonymous person

ORIGINAL ADVISORY:
2) http://www.craigheffner.com/security/exploits/upload_tool_php.txt

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------