XODA 0.4.5 Arbitrary PHP File Upload
63Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendcvss 9.3epss 1.1%
de la publicación al arma0 días
Publicada en NVD8 ago
metasploit21 ago
probabilidad de explotación
1.1%top 37% de las CVE
explotación observada
noninguna fuente lo reporta
3 exploit(s) público(s)
XODA version 0.4.5 contains an unauthenticated file upload vulnerability that allows remote attackers to execute arbitrary PHP code on the server. The flaw resides in the upload functionality, which fails to properly validate or restrict uploaded file types. By crafting a multipart/form-data POST request, an attacker can upload a .php file directly into the web-accessible files/ directory and trigger its execution via a subsequent GET request.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
XODA · XODAPoCs públicas encontradas — 3
cve_referenceraw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/xoda_file_upload.rbno verificadocve_referencewww.exploit-db.com/exploits/20703no verificadocve_referencewww.exploit-db.com/exploits/20713no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/xoda_file_upload.rbhttps://sourceforge.net/projects/xoda/https://www.exploit-db.com/exploits/20703https://www.exploit-db.com/exploits/20713https://www.vulncheck.com/advisories/xoda-arbitrary-php-file-uploadhttps://xoda.org/