OSVDB ID: 47630

Title: Phlatline's Personal Information Manager (pPIM) upload.php File Upload Arbitrary Code Execution

Info

Disclosure
Aug 11, 2008

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Unknown

Description

 Phlatine's Personal Information Manager (pPIM) contains a flaw that may allow a remote attacker to execute arbitrary code. The issue is due to the 'upload.php' script allowing the upload of files with arbitrary extensions to a folder inside the webroot. This may allow an attacker to upload arbitrary files, and for example, execute arbitrary PHP code.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Solution Unknown
Exploit: Exploit Public
Disclosure: Third-party Verified, Uncoordinated Disclosure
OSVDB: Web Related

Solution

 OSVDB is not aware of a solution for this vulnerability.

Products

phlatine

Phlatine's Personal Information Manager (pPIM)

 1.0
1.01

References

Credit

Unknown or Incomplete


Direct URL: http://osvdb.org/47630