Gleamtech FileVista / FileUltimate version 4.6 suffers from a directory traversal vulnerability.
109f5ca5f5be84fd82191d8a0fbff91cbb160e954b6e4083b398af37397fc8ba
- Title: GleamtechFileVista/FileUltimate 4.6 Directory Traversal can lead to file upload attack
- Credit goes to: Soroush Dalili
- Link: http://www.gleamtech.com/download
- Description:
It is possible to bypass directory traversal validation of FileVista/FileUltimate version 4.3 by using "..[SPACE]/" or "..[SPACE]\". As a result, it can be possible to bypass the security restrictions and upload an arbitrary file and execute that on the server.
- PoC: http://www.youtube.com/v/HjS6Pob5t34?version=3&hl=en_US&rel=0&vq=hd720
Regards
Soroush Dalili