Summary
This host is running AjaXplorer with zoho
plugin and is prone to directory traversal and file upload vulnerability.
Impact
Successful exploitation may allow an attacker
to obtain sensitive information, and upload a malicious PHP script, which could allow the attacker to execute arbitrary PHP code on the affected system.
Impact Level: System/Application
Solution
Upgrade to AjaXplorer 5.0.4 or later.
For updates refer to http://pyd.io
Insight
The flaws exist due to improper validation
of user-supplied input via 'name' parameter and improper validation of file extensions by the save_zoho.php script.
Affected
AjaXplorer zoho plugin 5.0.3 and probably
before.
Detection
Send a crafted exploit string via HTTP GET
request and check whether it is able to read the system file or not.
References
Severity
Classification
-
CVE CVE-2013-6226, CVE-2013-6227 -
CVSS Base Score: 8.5
AV:N/AC:L/Au:N/C:C/I:N/A:P
Related Vulnerabilities