Secunia

Paul Craig has reported a vulnerability in the Avatar Mod module for Snitz Forums, which can be exploited by malicious users to compromise a vulnerable system.

The vulnerability is caused due to an input validation error in the handling of avatar uploads in avatar_upload.asp. This can be exploited to upload scripts to a location inside the web root by including a null byte in the avatar filename.

Example:
test.asp[null byte].jpg

Successful exploitation requires administrative privileges.

The vulnerability has been reported in version 1.3. Other versions may also be affected.

Solution
Apply code changes as instructed by the vendor:
Further details available in Customer Area

Provided and/or discovered by
Paul Craig

Changelog
Further details available in Customer Area

Original Advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/046115.html

Deep Links
Links available in Customer Area