| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 6 Nov 2008 01:45:08 -0700 From: XiaShing@...il.com To: bugtraq@...urityfocus.com Subject: Remote access vulnerability using BigDump ver. 0.29b ============================================================ !vuln BigDump ver. 0.29b Previous versions may also be affected. ============================================================ ============================================================ !risk Medium There are currently many websites circulating with BigDump enabled. ============================================================ ============================================================ !dork Dork: intitle:"BigDump ver. 0.29b" ============================================================ ============================================================ !discussion A user is able to successfully upload files onto a server by uploading a php shell such as c99.php, by renaming it c99.php.sql ============================================================ ============================================================ !solution Do not use BigDump or put non-root/guest permissions on the folder containing BigDump. The vendor has not yet been notified. ============================================================ ============================================================ !greetz Greetz go out to the people who know me. ============================================================ ============================================================ !author Xia Shing Zee ============================================================
Powered by blists - more mailing lists