Description

Unrestricted file upload vulnerability in signup.php in e107 0.7.8 and earlier, when photograph upload is enabled, allows remote attackers to upload and execute arbitrary PHP code via a filename with a double extension such as .php.jpg.

Remediation

References

CVE-2007-3429

Related Vulnerabilities

Sqlite Use After Free Vulnerability (CVE-2020-13630)

WordPress Plugin Form Maker by 10Web-Mobile-Friendly Drag & Drop Contact Form Builder Cross-Site Scripting (1.13.59)

Jenkins Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-2601)

Oracle Database Server Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2012-3132)

Apache HTTP Server CVE-2009-3720 Vulnerability (CVE-2009-3720)

Severity

Medium

Classification

CVE-2007-3429

Tags

Missing Update Known Vulnerabilities