| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <Rs1K5j5DQMg3YaUfeN5WIRxLZWLaR4_KQRB44lgHFUMXFhqnH8YYErY7MzSMqGarrSOSvXsHVnXC2Gfe0b9vSaPh9IngxiWXMge6_OnVc04=@protonmail.com> Date: Tue, 12 Nov 2019 16:38:37 +0000 From: infinitybuzz via Fulldisclosure <fulldisclosure@...lists.org> To: fulldisclosure <fulldisclosure@...lists.org> Subject: [FD] Centraleyezer: Unrestricted File Upload -[CVE-2019-12271] Centraleyezer: Unrestricted File Upload -[CVE-2019-12271] Sandline Centraleyezer (On Premises) allows unrestricted File Upload with a dangerous type, because the feature of adding “.jpg” to any uploaded filename is not enforced on the server side. The image upload is vulnerable to bypass, the file upload adds .jpg extension to every file sent, but on client side, so I could intercept the request and change it to .php. I uploaded a simple shell and was able to execute commands as user www-data on the server. more information: https://link.medium.com/Y2S4ZJbMy1 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists