Description
The Aggregation module 5.x before 5.x-4.4 for Drupal allows remote attackers to upload files with arbitrary extensions, and possibly execute arbitrary code, via a crafted feed that allows upload of files with arbitrary extensions.
References
- http://drupal.org/node/269479
- 29677 vdb-entry
- aggregation-unspecified-file-upload(43011) vdb-entry
- 30618 third-party-advisory