Secunia

Liz0ziM has reported a vulnerability in PHP Upload Center, which potentially can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to an error in the handling of file uploads where a filename has multiple file extensions. This can be exploited to upload malicious PHP script files into the upload directory inside the web root.

Example:
file.php.x

The vulnerability has been reported in version 1.4. Other versions may also be affected.

Solution
Edit the configuration file to ensure that PHP script files are correctly rejected or place the upload directory outside the web root.

Provided and/or discovered by
Liz0ziM

Changelog
Further details available in Customer Area

Original Advisory
http://biyosecurity.be/bugs/phpuploadcenter2.txt

Deep Links
Links available in Customer Area