CVE-2007-2025 Information

Description

Unrestricted file upload vulnerability in the UpLoad feature (lib/plugin/UpLoad.php) in PhpWiki 1.3.11p1 allows remote attackers to upload arbitrary PHP files with a double extension as demonstrated by .php.3 which is interpreted by Apache as being a valid PHP file.

Reference

http://secunia.com/advisories/25307 http://secunia.com/advisories/26784 http://www.debian.org/security/2007/dsa-1371 http://www.gentoo.org/security/en/glsa/glsa-200705-16.xml http://www.nabble.com/Important-UpLoad-security-fix21-was–Fwd3A–phpwiki—Open-Discussion–RE3A-upload-security-risk–t3543463.html https://sourceforge.net/forum/message.php?msg_id=4249177