Description
Unrestricted file upload vulnerability in the Project issue tracking 4.7.0 through 5.x before 20070123, a module for Drupal, allows remote authenticated users to execute arbitrary code by attaching a file with executable or multiple extensions to a project issue.
References
- 23887 third-party-advisory
- 22224 vdb-entry
- projecttracking-extension-file-upload(31729) vdb-entry
- ADV-2007-0312 vdb-entry
- 32134 vdb-entry
- http://drupal.org/node/112146