Description
choose_file.php in easy-CMS 0.1.2, when mod_mime is installed, does not restrict uploads of filenames with multiple extensions, which allows remote attackers to execute arbitrary PHP code by uploading a PHP file with a GIF file extension, then directly accessing that file in the Repositories directory.
References
- 20733 third-party-advisory
- 20060618 Easy CMS 0.1.2 Php Shell Upload Vulnerabilities mailing-list
- 1016335 vdb-entry
- ADV-2006-2419 vdb-entry
- http://biyosecurity.be/bugs/easycms.txt
- 18496 vdb-entry
- 26633 vdb-entry
- easycms-extensions-file-upload(27281) vdb-entry