Release Date: 2004-02-09
Critical: Highly critical
Impact: Security Bypass, System access
Where: From remote
Software: Jacks FormMail.php 5.x
Description:
Himeur Nourredine has reported a vulnerability, potentially allowing malicious people to compromise a vulnerable system.
The problem is that filenames aren't properly verified and that the only "security" check is based on the "Referer:" header. This can be exploited to upload files to arbitrary directories by inserting fake information in the header and then constructing a malicious filename including the classic "../" directory traversal character sequence.
The vulnerability has been reported in version 5.0.
Solution:
Edit the source code and remove the upload functionality.
Write protect all public folders to ensure that files can only be written to a dedicated and protected upload folder.
Provided and/or discovered by:
Himeur Nourredine
Source: Secunia