----------------------------------------------------------------------

Do you have VARM strategy implemented?

(Vulnerability Assessment Remediation Management)  

If not, then implement it through the most reliable vulnerability
intelligence source on the market. 

Implement it through Secunia. 

For more information visit:
http://secunia.com/advisories/business_solutions/

Alternatively request a call from a Secunia representative today to
discuss how we can help you with our capabilities contact us at:
sales@secunia.com

----------------------------------------------------------------------

TITLE:
eZoneScripts.com Hot Or Not Script Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA35240

VERIFY ADVISORY:
http://secunia.com/advisories/35240/

DESCRIPTION:
Some vulnerabilities have been reported in Hot or Not Script, which
can be exploited by malicious people to bypass certain security
restrictions, disclose sensitive information, or to compromise a
vulnerable system.

1) Access to admin/backup/backup.php is not properly restricted,
which can be exploited to download database backups and to e.g.
disclose the password of the administrative user.

2) The file type of uploaded files is not properly verified in
admin/sitebanners/upload_banners.php before the file is being stored
in a web-accessible directory. This can be exploited to upload
arbitrary files (e.g. PHP files).

3) Access to adminl/sitebanners/upload_banners.php is not properly
restricted, which can be exploited to e.g. upload and execute
arbitrary PHP code.

Note: This may be related to SA28261.

SOLUTION:
Restrict access to the "admin" and the "backup" directory (e.g. via a
".htaccess" file).

PROVIDED AND/OR DISCOVERED BY:
sniper code

ORIGINAL ADVISORY:
http://milw0rm.com/exploits/8793

OTHER REFERENCES:
SA28261:
http://secunia.com/advisories/28261/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------