Secunia

ZoRLu has reported a vulnerability multiple ScriptsFeed products, which can be exploited by malicious users to compromise a vulnerable system.

The vulnerability is caused due to the applications not properly verifying the file type of uploaded pictures. This can be exploited to upload files with arbitrary extensions (e.g. ".php") and execute arbitrary PHP code on the server.

This vulnerability is reported in the following products:
- ScriptsFeed Recipes Listing Portal
- ScriptsFeed Auto Classifieds Software
- ScriptsFeed Realtor Classifieds System

Solution
Edit the source code to ensure that file types are properly verified.

Provided and/or discovered by
ZoRLu

Changelog
Further details available in Customer Area

Original Advisory
http://www.milw0rm.com/exploits/7110
http://www.milw0rm.com/exploits/7111
http://www.milw0rm.com/exploits/7112

Deep Links
Links available in Customer Area