Secunia

ReZEN and 0xception have discovered a vulnerability in Simple PHP Blog, which can be exploited by malicious users to compromise a vulnerable system.

The vulnerability is caused to upload_img_cgi.php failing to validate the extension of an uploaded image file. This can be exploited to upload files with arbitrary extensions (e.g. ".php") and execute arbitrary PHP code on the server.

NOTE: This is actively being exploited.

The vulnerability is confirmed in version 0.4.0. Other versions may also be affected.

Solution
Update to version 0.5.1.

Provided and/or discovered by
ReZEN and 0xception

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area