CVE-2006-2330

Published: May 12, 2006Modified: Apr 16, 2026

6.4

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability: 10.0 / Impact: 4.9

Source: NVD

Description

PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary types using a filename that contains two or more extensions that ends in an assumed-valid extension such as .gif, which bypasses the validation, as demonstrated by uploading then executing an avatar file that ends in ".php.gif" and contains PHP code in EXIF metadata.

Affected (11)

Products: Php Fusion: Php Fusion

Php Fusion

1 product

Php Fusion

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Php Fusion Php Fusion	Version 6.00.105
Php Fusion Php Fusion	Version 6.00.106
Php Fusion Php Fusion	Version 6.00.107
Php Fusion Php Fusion	Version 6.00.109
Php Fusion Php Fusion	Version 6.00.110
Php Fusion Php Fusion	Version 6.00.204
Php Fusion Php Fusion	Version 6.00.206
Php Fusion Php Fusion	Version 6.00.303
Php Fusion Php Fusion	Version 6.00.304
Php Fusion Php Fusion	Version 6.00.306
Php Fusion Php Fusion	Version 6.00.3