Description
Attachment Mod 2.3.10 module for phpBB, when used with Apache mod_mime, does not properly handle files with multiple file extensions, such as .php.rar, which allows remote attackers to upload and execute arbitrary code.
References
- 13421 third-party-advisory
- 20041216 STG Security Advisory: [SSA-20041215-18] Vulnerability of uploading files with multiple extensions in phpBB Attachment Mod mailing-list
- 11893 vdb-entry
- http://www.opentools.de/board/viewtopic.php?t=3590
- attachment-mod-file-upload(18438) vdb-entry