OSVDB ID: 22793 Title: HTMLArea files.php Unauthenticated Arbitrary File Upload |
Info |
|
|
Dates |
||||
|
|
Description |
HTMLArea contains a flaw that may allow a malicious user to execute arbitrary commands. The '/admin/htmlarea/popups/file/files.php' script is accessible without authentication, allowing a remote attacker to use this script to upload malicious PHP files and execute arbitrary code on the system. |
Classification |
Location:
Remote/Network Access Required
Attack Type: Input Manipulation Impact: Unknown Exploit: Exploit Available Disclosure: OSVDB Verified OSVDB: Web Related |
Solution |
Currently, there are no known upgrades, patches, or workarounds available to correct this issue in HTMLArea. Upgrade to version 6.2 or higher, as it has been reported to fix this vulnerability. In addition, Chain Reaction Works, Inc. has released a patch for some older versions. |
Products |
|
References |
|
Credit |
|