PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary types using a filename that contains two or more extensions that ends in an assumed-valid extension such as .gif, which bypasses the validation, as demonstrated by uploading then executing an avatar file that ends in .php.gif and contains PHP code in EXIF metadata.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Php_fusion | Php_fusion | 6.00.3 (including) | 6.00.3 (including) |
| Php_fusion | Php_fusion | 6.00.105 (including) | 6.00.105 (including) |
| Php_fusion | Php_fusion | 6.00.106 (including) | 6.00.106 (including) |
| Php_fusion | Php_fusion | 6.00.107 (including) | 6.00.107 (including) |
| Php_fusion | Php_fusion | 6.00.109 (including) | 6.00.109 (including) |
| Php_fusion | Php_fusion | 6.00.110 (including) | 6.00.110 (including) |
| Php_fusion | Php_fusion | 6.00.204 (including) | 6.00.204 (including) |
| Php_fusion | Php_fusion | 6.00.206 (including) | 6.00.206 (including) |
| Php_fusion | Php_fusion | 6.00.303 (including) | 6.00.303 (including) |
| Php_fusion | Php_fusion | 6.00.304 (including) | 6.00.304 (including) |
| Php_fusion | Php_fusion | 6.00.306 (including) | 6.00.306 (including) |