NEPT Image Uploader 1.0 Arbitrary Shell Upload Vulnerability

2009.06.05
Credit: Dentrasi
Risk: High
Local: No
Remote: Yes
CVE: CVE-2008-6822
CWE: CWE-20


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

//Title - NEPT Image Uploader shell upload //Vendor - newearthpt.freehostia.com //Version - 1.0 //Status - vendor has been notified //Author - Dentrasi //Description It is possible to upload a php script to the remote site. 1. Select a php file for upload 2. Select it for upload, and tamperdata the request 3. Change the Content-Type from 'application/octet-stream' to 'image/jpeg' 4. If the link provided gives a 404, add 'upload/' before the file name


See this note in RAW Version
Vote for this issue:
50%
50%

Comment it here.
Copyright 2025, cxsecurity.com

 

Back to Top