Report generated by Hoyt LLC at Wed Sep 22 21:57:40 EDT 2010.

The DORK Report


1. File upload functionality

1. File upload functionality


Severity:   Information
Confidence:   Certain
Path:   /Configurations/AutoScriptCopy.aspx

Issue detail

The page contains a form which is used to submit a user-supplied file to the following URL:Note that Burp has not identified any specific security vulnerabilities with this functionality, and you should manually review it to determine whether any problems exist.

Issue background

File upload functionality is commonly associated with a number of vulnerabilities, including:You should review the file upload functionality to understand its purpose, and establish whether uploaded content is ever returned to other application users, either through their normal usage of the application or by being fed a specific link by an attacker.

Some factors to consider when evaluating the security impact of this functionality include:

Issue remediation

File upload functionality is not straightforward to implement securely. Some recommendations to consider in the design of this functionality include:


GET /Configurations/AutoScriptCopy.aspx HTTP/1.1
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: AdminName=03B090AD5F97C70D4DC47E1F79D0478B14D58B7E02C9D5E2CAF5156188725F913C0DEC85C1F90A3AE0F60B578414178E9C8ECC17D03B469D941E54A8504A3B7FE1AC4FACC8ACCC3B0D9AD9A5DBD43DE9; SkinName=Blue; DateFormat=dd/mm/yy; ThemeName=VogueTree; Language=English; ASP.NET_SessionId=wb3whmyqzmyp2gzuei32poui; Dateformat=dd/mm/yy; ShowQuickHelp=1;


HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Date: Thu, 23 Sep 2010 01:48:21 GMT
Connection: close
Content-Length: 12278

<div id="general" style="VISIBILITY:visible; FONT:10px bold"><input onclick="__doPostBack('btnSaveSettings','')" name="btnSaveSettings" type="button" id="btnSaveSettings" value="Button" /><input onc
<td height="20" class="FieldBgColor">
<input name="ZipFile" type="file" id="ZipFile" size="30" />

Report generated by Hoyt LLC at Wed Sep 22 21:57:40 EDT 2010.