OSVDB ID: 19879

Title: Avi Alkalay contribute.cgi/contribute.pl contribdir Variable Arbitrary File Overwrite

Info

Disclosure

Oct 08, 2005

Discovery

Sep 28, 2005

Dates

Exploit

Sep 28, 2005

Solution

Unknown

Description

Celular contribute.cgi or contribute.pl scripts contains a flaw that allows a remote attacker to overwrite arbitrary files. The issue is due to the contribute.pl or contribute.cgi script not properly sanitizing user input, specifically values supplied via the contribdir variable.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Confidentiality
Exploit: Exploit Public
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Products

Avi Alkalay	contribute.pl	16 Jun 2002
Avi Alkalay	contribute.cgi	16 Jun 2002

References

Secunia Advisory ID: 16895
Related OSVDB ID: 19519 19520 19521 19522
CVE ID: 2005-3097 (see also: NVD)
Other Advisory URL: http://osvdb.org/ref/19/19879-christey.txt
Vendor URL: http://www.alkalay.net/software/

Credit

Steven M. Christey - coleymitre.org - MITRE

Direct URL: http://osvdb.org/19879