Vulnerabilities > CVE-2007-1604 - Arbitrary File Upload vulnerability in W-Agora 4.2.1

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
w-agora
exploit available
NVD
Published: 2007-03-22
Updated: 2018-10-16

Summary

Multiple unrestricted file upload vulnerabilities in w-Agora (Web-Agora) allow remote attackers to upload and execute arbitrary PHP code (1) via a forum message with an attached file, which is stored under forums/hello/hello/notes/ or (2) by using browse_avatar.php to upload a file with a double extension, as demonstrated by .php.jpg.

Vulnerable Configurations

Part Description Count
Application
W-Agora
1

Exploit-Db

descriptionW-Agora 4.2.1 Multiple Arbitrary File Upload Vulnerabilities. CVE-2007-1604. Webapps exploit for php platform
idEDB-ID:29763
last seen2016-02-03
modified2007-03-20
published2007-03-20
reporterlaurent gaffie
sourcehttps://www.exploit-db.com/download/29763/
titleW-Agora 4.2.1 - Multiple Arbitrary File Upload Vulnerabilities

References