Ravens PHP Scripts - PHP Upload Tool File Upload And Directory Traversal

SECUNIA ADVISORY ID: SA22973

VERIFY ADVISORY: http://secunia.com/advisories/22973/

CRITICAL: Moderately critical

IMPACT: Exposure of system information, Exposure of sensitive information, System access

SOFTWARE: PHP Upload Tool 1.x - http://secunia.com/product/12655/

DESCRIPTION: Some vulnerabilities have been discovered in PHP Upload Tool, which can be exploited by malicious users to gain system access or by malicious people to expose sensitive information. The vulnerabilities are confirmed in version 1.0. Other versions may also be affected.

1) The bin/main_user.php script fails to validate the extension of an uploaded file. This can be exploited to upload files with arbitrary extensions (e.g. ".php") and execute arbitrary PHP code on the server. Successful exploitation requires valid user credentials.

2) Input passed to the "filename" parameter in bin/download.php is not properly sanitised before being used to download files. Successful exploitation allows for downloading of arbitrary files on the system, e.g. "/etc/passwd" or "conf/users.conf" (the product's usernames and password hashes).

SOLUTION: Edit the source code to ensure that input is properly verified and sanitised. Restrict access to the application, e.g. with an ".htaccess" file.

PROVIDED AND/OR DISCOVERED BY: Craig Heffner and an anonymous person

ORIGINAL ADVISORY: 2) http://www.craigheffner.com/security/exploits/upload_tool_php.txt