OSVDB ID: 47630

Title: Phlatline's Personal Information Manager (pPIM) upload.php File Upload Arbitrary Code Execution

Info

Disclosure

Aug 11, 2008

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

Phlatine's Personal Information Manager (pPIM) contains a flaw that may allow a remote attacker to execute arbitrary code. The issue is due to the 'upload.php' script allowing the upload of files with arbitrary extensions to a folder inside the webroot. This may allow an attacker to upload arbitrary files, and for example, execute arbitrary PHP code.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Solution Unknown
Exploit: Exploit Public
Disclosure: Third-party Verified, Uncoordinated Disclosure
OSVDB: Web Related

Solution

OSVDB is not aware of a solution for this vulnerability.

Products

phlatine

Phlatine's Personal Information Manager (pPIM)

1.0
1.01

References

Credit

Unknown or Incomplete



Direct URL: http://osvdb.org/47630