[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : NEPT Image Uploader 1.0 Arbitrary Shell Upload Vulnerability
# Published : 2008-10-24
# Author : Dentrasi
# Previous Title : Aj RSS Reader (EditUrl.php url) SQL Injection Vulnerability
# Next Title : PHPdaily (SQL/XSS/LFD) Multiple Remote Vulnerabilities
//Title - NEPT Image Uploader shell upload
//Vendor - newearthpt.freehostia.com
//Version - 1.0
//Status - vendor has been notified
//Author - Dentrasi
//Description
It is possible to upload a php script to the remote site.
1. Select a php file for upload
2. Select it for upload, and tamperdata the request
3. Change the Content-Type from 'application/octet-stream' to 'image/jpeg'
4. If the link provided gives a 404, add 'upload/' before the file name
# www.Syue.com [2008-10-24]