0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Thomson Reuters FATCA Arbitrary File Upload Vulnerability
Author
Risk
[Security Risk High
]0day-ID
Category
Date add
CVE
Platform
Title: Thomson Reuters FATCA - Arbitrary File Upload Author: Jakub Pałaczyński Date: 10. June 2015 CVE: CVE-2015-5951 Affected software: ================== All versions of Thomson Reuters FATCA below v5.2 Exploit was tested on: ====================== Thomson Reuters FATCA v5.1.0.30 Description: ============ The Thomson Reuters for FATCA solution enables organizations to comply with the key requirements of both CRS and FATCA.[1] Vulnerabilities: **************** Arbitrary File Upload: ============================================ FATCA users are able to upload any type of file (including PHP scripts) on the server. To successfully exploit this vulnerability it is possible for example to use Directory Traversal in "specid" parameter to upload PHP file to web root of the application and finally execute system commands. References: =========== [1] Overview: https://risk.thomsonreuters.com/products/thomson-reuters-fatca Contact: ======== Jakub[dot]Palaczynski[at]ingservicespolska[dot]pl # 0day.today [2024-12-26] #