Title: [Kil13r-SA-20060606] ESTsoft InternetDISK Arbitary Code Execution Vulnerability
Author: Kil13r - http://www.kil13r.info/ Local / Remote: Remote Timeline: 2006/04/19 - Discovery 2006/04/19 - Vendor notification 2006/04/20 - Vendor response 2006/04/20 - Vendor patch release 2006/05/10 - Vendor inspect security 2006/06/06 - Release Affected version: ESTsoft InternetDISK (~2006/04/19) Not affected version: ESTsoft InternetDISK (2006/04/20~) Description: ESTsoft InternetDISK is web storage solution, but that has serious vulnerability. It can run arbitary PHP code by end user. If attacker run arbitary PHP code, attacker can control server. Proof of Concept code: http://www.victim.com/WebLink/yourid/somephpcode.php.kr Proof of Concept example: None Proof of Concept screenshot: None
