NVD

Id
61032  
Name
CVE-2006-2330  
Description
PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary types using a filename that contains two or more extensions that ends in an assumed-valid extension such as .gif, which bypasses the validation, as demonstrated by uploading then executing an avatar file that ends in ".php.gif" and contains PHP code in EXIF metadata.  
Reject
 
CVSS Version
2  
CVSS Score
6.4  
Severity
Medium  
CVSS Base Score
6.4  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:N)  
Pub Date
2016-12-20  
Published
2006-05-11  
Modified Date
2011-03-07  
Seq
2006-2330  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
315228 61032 CVE-2006-2330 873  View
315229 61032 CVE-2006-2330 http://www.php-fusion.co.uk/news.php  View
315230 61032 CVE-2006-2330 20060508 PHPFusion <= v6.00.306 avatar mod_mime arbitrary file upload & local inclusion vulnerabilities  View
315231 61032 CVE-2006-2330 17898  View
315232 61032 CVE-2006-2330 ADV-2006-1735  View
315233 61032 CVE-2006-2330 phpfusion-avatar-extensions-code-execution(26388)  View

Related JVN