Metrics
Metrics |
Score |
Severity |
CVSS Vector |
Source |
V2 |
6.8 |
|
AV:N/AC:M/Au:N/C:P/I:P/A:P |
nvd@nist.gov |
EPSS
EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.
EPSS Score
The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.
EPSS Percentile
The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
Exploit information
Exploit Database EDB-ID : 4099
Publication date : 2007-06-23 22h00 +00:00
Author : g00ns
EDB Verified : Yes
###############################################################################################
# ___ ___ _
# / _ \ / _ \ | |
# __ _| | | | | | |_ __ ___ _ __ ___| |_
# / _` | | | | | | | '_ \/ __| | '_ \ / _ \ __|
# | (_| | |_| | |_| | | | \__ \_| | | | __/ |_
# \__, |\___/ \___/|_| |_|___(_)_| |_|\___|\__|
# __/ |
# |___/
###############################################################################################
#INFO:
#Program Title ################################################################################
#e107 <= 0.7.8 - Arbitrary File Upload
#
#Description ##################################################################################
#"e107 is a content management system written in PHP and using the popular open source MySQL
#database system for content storage. It's completely free, totally customisable and in
#constant development" - e107.org
#
#Script Download ##############################################################################
#http://e107.org/edownload.php
#
#Original Advisory ############################################################################
#http://www.g00ns-forum.net/showthread.php?t=9388
#
#Vuln #########################################################################################
#vuln discovered by clorox
#shoutz: z3r0, milf, blackhill, godxcel, murderskillz, kirby, katalyst, SyNiCaL, OD, pr0be, rezen, str0ke,
#fish, rey, canuck, ,vipsta, c0ma, grumpy, sick, trin, asdfhacks.com , a59, freeillwill.com, seven, tower, fury,
#SS, <S>, Bernard, rst.void.ru, awesome andrew, and everyone else at g00ns.net
#
#Details ######################################################################################
#note: e107 is only vulnerable if it allows you to upload a photograph, avatars will not work.#
#to enable this an admin has to manually the settings in change e107_admin/users.php?options #
###############################################################################################
#signup.php does not verify that a file submitted as an image is actually an image. it controls files uploaded
#only by the extension. files with a .php extension are blocked, but you can simply rename a php document to
#document.php.jpg and it passes the image verification and is uploaded. to get the path of the file you uploaded
#you view your profile, view the source of the page and search for the name of the file and it will be there with
#a few random numbers in it, and now all an attacker would have to do is simply call the evil script up and the
#server has been compromised.
#GoogleDork: "Please note: Any image uploaded to this server that is deemed inappropriate by the administrators will be deleted immediately."
#
################################################################################################
# milw0rm.com [2007-06-24]
Products Mentioned
Configuraton 0
E107>>E107 >> Version 0.7
E107>>E107 >> Version 0.7.1
E107>>E107 >> Version 0.7.2
E107>>E107 >> Version 0.7.3
E107>>E107 >> Version 0.7.4
E107>>E107 >> Version 0.7.5
E107>>E107 >> Version 0.7.6
E107>>E107 >> Version 0.7.7
E107>>E107 >> Version 0.7.8
References