NeatMonster/SpaceBukkit — Issue #79: Possible Remote File Upload in uploadify.php
Author: N3XT0R
Created: 2012-01-01 21:26:56+00:00
State: open

vuln File:
"./uploads/uploadify.php"

line 26-41

Description:
Its possibile to upload malware to the remote server like shells, Remote Access Tools or else.
Because the script doesn't check the filetype or filter the uploadlocation.
So its possible to upload anything to anywhere.

line 27 - 28:
$tempFile = $_FILES['Filedata']['tmp_name'];
$targetPath = $_SERVER['DOCUMENT_ROOT'] . $_REQUEST['folder'] . '/'; // <-- bad idea

Here can choose the attacker the upload directory. It can be inside the document_root or outside (eg. with "../../")

line 40:
move_uploaded_file($tempFile,$targetFile);

Here the file will be upload without checking anything.

So if anyone want to upload any file, he can.

proof: