CVE-2006-2330
MEDIUM 6.4EPSS 7.8%
PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary types using a filename that contains two or more extensions that ends in an assumed-valid extension such as .gif, which bypasses the validation, as demonstrated by uploading then executing an avatar file that ends in ".php.gif" and contains PHP code in EXIF metadata.
- CVSS v2.0 NVD
- 6.4 MEDIUM
AV:N/AC:L/Au:N/C:P/I:P/A:N - EPSS
- 7.83% chance of exploitation in the next 30 days, 95th percentile
- Published
- 2006-05-12
- Updated
- 2024-08-07
ExploitDB entries (1)
Security advisories
- http://secunia.com/advisories/19992
- http://www.php-fusion.co.uk/news.php
- http://www.securityfocus.com/bid/17898