Description
The Announce module in phpWebSite 0.10.0 and earlier allows remote attackers to execute arbitrary PHP code by setting the Image field to reference a PHP file whose name contains a .gif.php extension.
References
- 20050224 phpWebSite-0.10.0_exploit mailing-list
- GLSA-200503-04 vendor-advisory
- 1013298 vdb-entry
- phpwebsite-announce-execute-code(19482) vdb-entry
- 14399 third-party-advisory