Description
Race condition in articles/BitArticle.php in Bitweaver 1.3, when run on Apache with the mod_mime extension, allows remote attackers to execute arbitrary PHP code by uploading arbitrary files with double extensions, which are stored for a small period of time under the webroot in the temp/articles directory.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Bitweaver 1.3 - 'tmpImagePath' Attachment mod_mime EDB-1918 · webapps · Jun 15, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://sourceforge.net/project/shownotes.php?release_id=336854&group_id=141358
- http://retrogod.altervista.org/bitweaver_13_xpl.html
- bitweaver-modmime-file-upload(27215) vdb-entry
- 1918 exploit
- 26587 vdb-entry
- 20695 third-party-advisory
- http://www.bitweaver.org/articles/45
- 1115 third-party-advisory
- ADV-2006-2405 vdb-entry
- 20060617 bitweaver <= v1.3 multiple vulnerabilities mailing-list