Description
image.php in vBulletin 3.0.9 and earlier allows remote attackers with access to the administrator panel to upload arbitrary files via the upload action.
References
- vbulletin-image-file-upload(22325) vdb-entry
- http://morph3us.org/advisories/20050917-vbulletin-3.0.8.txt
- 20050918 [BuHa-Security] Multiple vulnerabilities in (admincp/modcp of) mailing-list
- 16873 third-party-advisory