============================================================ !vuln File Thingie v2.5.4 Previous versions may also be affected. ============================================================ ============================================================ !risk Low There are currently just a few websites circulating with File Thingie enabled. ============================================================ ============================================================ !dork Dork: intitle:"File Thingie 2.5.4" ============================================================ ============================================================ !discussion A user is able to successfully upload files onto a server by uploading a php shell such as c99.php, by renaming it c99.php.sql ============================================================ ============================================================ !notes This is the exact same vulnerability that affected BigDump v0.29b. ============================================================ ============================================================ !solution Do not use File Thingie or put non-root/guest permissions on the folder containing File Thingie. The vendor has not yet been notified. ============================================================ ============================================================ !greetz Greetz go out to the people who know me. ============================================================ ============================================================ !author Xia Shing Zee ============================================================
