CVE-2007-6676 Information

Description

The default configuration of Uber Uploader (UU) 5.3.6 and earlier does not block uploads of (1) .html (2) .asp and other possibly dangerous extensions which allows remote attackers to use these extensions in uploads via (a) uu_file_upload.php related to uu_file_upload.js and (b) uber_uploader_file.php related to uber_uploader_file.js a different issue than CVE-2007-0123. NOTE: the vendor disputes the severity of the issue noting that it is the administrator’s responsibility to \add file extensions that you may or may not want uploaded.\

Reference

http://osvdb.org/43535 http://securityreason.com/securityalert/3519 http://www.securityfocus.com/archive/1/485235/100/100/threaded http://www.securityfocus.com/archive/1/485290/100/100/threaded