Description
logahead UNU 1.0 before 20061226 allows remote attackers to upload arbitrary files via unspecified vectors related to plugins/widged/_widged.php (aka the WidgEd plugin), possibly because of an authentication bypass. NOTE: some of these details are obtained from third party information.
References
- 20061225 logahead UNU edition 1.0 Remote File Upload & code execution mailing-list
- ADV-2006-5184 vdb-entry
- 21743 vdb-entry
- 2071 third-party-advisory
- 1017444 vdb-entry
- 23470 third-party-advisory
- http://logahead.com/forums/comments.php?DiscussionID=216