Some vulnerabilities have been reported in Hot or Not Script, which can be exploited by malicious people to bypass certain security restrictions, disclose sensitive information, or to compromise a vulnerable system.

1) Access to admin/backup/backup.php is not properly restricted, which can be exploited to download database backups and to e.g. disclose the password of the administrative user.

2) The file type of uploaded files is not properly verified in admin/sitebanners/upload_banners.php before the file is being stored in a web-accessible directory. This can be exploited to upload arbitrary files (e.g. PHP files).

3) Access to adminl/sitebanners/upload_banners.php is not properly restricted, which can be exploited to e.g. upload and execute arbitrary PHP code.

Note: This may be related to SA28261.

Solution
Restrict access to the "admin" and the "backup" directory (e.g. via a ".htaccess" file).

Provided and/or discovered by
sniper code

Original Advisory
http://milw0rm.com/exploits/8793

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area