Description
The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected names via a crafted second argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.
Remediation
References
Related Vulnerabilities
WordPress Plugin ZoomSounds-WordPress Wave Audio Player with Playlist Arbitrary File Upload (2.0)
Oracle Application Server CVE-2008-7233 Vulnerability (CVE-2008-7233)
WordPress Plugin Ajax Multi Upload 'upload.php' Arbitrary File Upload (1.1)
WordPress Plugin WP Activity Log Cross-Site Request Forgery (4.1.3.2)
WordPress Plugin Easy Media Download Cross-Site Scripting (1.1.4)