Description
CMS Mundo before 1.0 build 008 does not properly verify uploaded image files, which allows remote attackers to execute arbitrary PHP code by uploading and later directly accessing certain files.
References
- http://secunia.com/secunia_research/2006-43/advisory/
- ADV-2006-2348 vdb-entry
- 20060614 Secunia Research: CMS Mundo SQL Injection and File UploadVulnerabilities mailing-list
- 26465 vdb-entry
- cmsmundo-php-file-upload(27094) vdb-entry
- 20362 third-party-advisory
- 1016311 vdb-entry