Secunia

Peter Österberg has discovered a vulnerability in the Automatic Image Upload with Thumbnails module for PunBB, which can be exploited by malicious users to conduct cross-site scripting attacks and to compromise a vulnerable system.

The uploadimg.php script fails to validate the extension of an uploaded file. This can be exploited to upload files with ".html" or ".php" extensions by passing an allowed MIME media type in the HTTP headers.

Successful exploitation allows to conduct cross-site scripting attacks or to execute arbitrary PHP code on the server, but requires valid user credentials in a group that is allowed to upload files.

The vulnerability is confirmed in version 1.3.3 and reported in version 1.3.2. Other versions may also be affected.

Solution
Implement whitelisting based on file extensions in uploaded files.
Further details available in Customer Area

Provided and/or discovered by
Peter Österberg, FortConsult A/S

Changelog
Further details available in Customer Area

Original Advisory
http://www.fortconsult.net/images/pdf/advisories/punBB_imgUpload.pdf

Deep Links
Links available in Customer Area