CVE-2005-1881

upload.php in YaPiG 0.92b, 0.93u and 0.94u does not properly restrict the file extension for uploaded image files, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code.

Score

CVSS 2.0 7.5 High

Status

Modified - cve@mitre.org

Published

2005-06-06

Last modified

2024-09-16

Weaknesses

CWE-434

Affected products

• Yapig (Yapig)

References

• http://secunia.com/advisories/15600/
• http://securitytracker.com/id?1014103
• http://secwatch.org/advisories/secwatch/20050530_yapig.txt
• http://www.osvdb.org/17115