CVE-2001-0437 upload_file.pl in DCForum 2000 1.0 allows remote attackers to upload arbitrary files without authentication by setting the az parameter to upload_file.
MediumCVSS 5.0
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
upload_file.pl in DCForum 2000 1.0 allows remote attackers to upload arbitrary files without authentication by setting the az parameter to upload_file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dcscripts dcforum | = 1.0 | No fix listed |
| dcscripts dcforum | = 2.0 | No fix listed |
| dcscripts dcforum | = 3.0 | No fix listed |
| dcscripts dcforum | = 4.0 | No fix listed |
| dcscripts dcforum | = 5.0 | No fix listed |
| dcscripts dcforum | = 6.0 | No fix listed |
| dcscripts dcforum 2000 | = 1.0 | No fix listed |
References
- 20010416 qDefense Advisory: DCForum allows remote read/write/execute mailing-list patch vendor-advisory
- www.dcscripts.com patch vendor-advisory
- 2611 patch vdb-entry vendor-advisory
- dcforum-az-file-upload(6393) vdb-entry