|
|
|
|
|
|
|
| |
O'Reilly WebSite uploader.exe Arbitrary File Upload |
|
| This script is Copyright (C) 1999-2010 Tenable Network Security, Inc. |
|
|
| Family | CGI abuses |
| Nessus Plugin ID | 10291 (uploader_exe.nasl) |
| Bugtraq ID |
|
| CVE ID | CVE-1999-0177
|
|
| Description: |
Synopsis :
The remote web server contains a CGI script that is prone to arbitrary
command execution.
Description :
The remote web server contains a CGI script named 'uploader.exe' in
'/cgi-win'. Versions of O'Reilly's Website product before 1.1g
included a script with this name that allows an attacker to upload
arbitrary CGI and then execute them.
See also :
http://www.nessus.org/u?4b667852
http://www.nessus.org/u?3bca098f
Solution :
Verify that the affected script does not allow arbitrary uploads and
remove it if it does.
Risk factor :
High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
|
|
|
|
|
|
