Home page logo

bugtraq logo Bugtraq mailing list archives

Re: LabWiki <= 1.1 Multiple Vulnerabilities
From: muuratsalo experimental hack lab <muuratsalo () gmail com>
Date: Wed, 9 Nov 2011 11:04:59 +0100

Dear all,
there is a small mistake in the Vulnerability overview: it is LabWiki
NOT LabStore!

2011/11/9 muuratsalo experimental hack lab <muuratsalo () gmail com>:
LabWiki <= 1.1 Multiple Vulnerabilities

author............: muuratsalo (Revshell.com)
contact...........: muuratsalo[at]gmail[dot]com
download..........: http://www.bioinformatics.org/phplabware/labwiki/index.php

[0x01] Vulnerability overview:

All versions of LabStore <= 1.1 are affected by multiple vulnerabilities.

[0x02] Disclosure timeline:

[08/11/2011] - Multiple vulnerabilities discovered and reported to the vendor.
[08/11/2011] - The vendor confirmed the vulnerabilities and he is
working on fixing the reported issues.
[09/11/2011] - Public Disclosure

[0x03] Vulnerabilities:

-- Shell Upload Vulnerability --
The upload script /edit.php improperly checks the filetype of uploaded images.
A 'shell.php.gif' is accepted.  /* -- note that access to edit.php
could be restricted-- */

-- Multiple Cross Site Scripting Vulnerabilities --

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]