HC's Capture the Flag website
CTF Contests
25C3-CTF
25C3-CTF final results
Advisory #113
From team WiiPhonies
New advisory by : c1de0x
Affected service(s): CGIBAS
Severity [lmh] : high
===== Problem =====
upload.bas allows to store into absolute paths.
===== Impact =====
Overwrite/create files wherever www-data can write.
===== Fix =====
Prepend ./ to all pathnames:
1923 let caption="./"; caption
Rating
[0] one score is nuff ... there were already too many scores given out for these bugs