A vulnerability has been identified in PHPStore Real Estate, which could be exploited by malicious users to compromise a vulnerable web server. This issue is caused by input validation errors in the file upload functionality when processing upload images, which could be exploited by authenticated users to upload malicious PHP scripts and execute arbitrary commands with the privileges of the web server.

Affected Products

PHPStore Real Estate

Solution

VUPEN Security is not aware of any vendor-supplied patch.

References

http://www.vupen.com/english/advisories/2008/3101

Credits

Vulnerability reported by ZoRLu.

Changelog

2008-11-11 : Initial release

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.