AspUpload Test11.asp Arbitrary File Upload

high Nessus Plugin ID 11746

Language:

Synopsis

The remote web server contains an ASP script that may allow uploading of arbitrary files.

Description

At least one example script distributed with AspUpload appears to be installed on the remote web server. AspUpload is an ASP script that supports saving and processing files uploading through other web scripts, and the example script likely contains a flaw that allows an attacker to upload arbitrary files and store them anywhere on the affected drive.

Solution

Unknown at this time.

Plugin Details

Severity: High

ID: 11746

File Name: uploadskrip.nasl

Version: 1.23

Type: remote

Family: CGI abuses

Published: 6/17/2003

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.2

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

Required KB Items: www/ASP

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Ease: No exploit is required

Vulnerability Publication Date: 11/30/2001

Reference Information

CVE: CVE-2001-0938

BID: 3608

Detections

Analytics