Description
SQL injection vulnerability in class-1 Forum Software 0.24.4 allows remote attackers to execute arbitrary SQL commands and bypass the file extension check via SQL code in the file extension of an uploaded file.
References
- 14774 vdb-entry
- 16762 third-party-advisory
- http://www.rgod.altervista.org/class1.html
- 20050908 class-1 Forum Software v 0.24.4 Remote code execution mailing-list
- class1forum-unknown-sql-injection(22209) vdb-entry