OSVDB ID: 25537 Title: PHP-Fusion File Upload Restriction Bypass |
Info |
|
|
Dates |
||||
|
|
Description |
PHP-Fusion contains a flaw that may allow a malicious user to upload avatar images with multiple file extensions. It is possible that the flaw may allow to execute arbitrary PHP code if used, for example, in conjunction with apache mod_mime module. |
Classification |
Location:
Remote / Network Access
Attack Type: Input Manipulation Impact: Loss of Integrity Exploit: Exploit Public Disclosure: OSVDB Verified OSVDB: Web Related |
Solution |
Upgrade to version 6.00.307 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. |
Products |
|
References |
|
Credit |
|
austici.org - Personal Page