Description
The custom avatar uploading feature (uploader.php) for XOOPS 2.0.9.2 and earlier allows remote attackers to upload arbitrary PHP scripts, whose file extensions are not filtered.
References
- 14520 third-party-advisory
- http://www.xoops.org/modules/news/article.php?storyid=2114
- 20050308 [SCAN Associates Security Advisory] xoops 2.0.9.2 and below weak file extension validation mailing-list
- 12754 vdb-entry
- xoops-uploader-file-upload(19634) vdb-entry