Improper input validation in Phpmotion

CVE-2008-3117

Unrestricted file upload vulnerability in update_profile.php in PHPmotion 2.0 and earlier allows remote authenticated users to execute arbitrary code by uploading a .php file with a content type of (1) image/gif, (2) image/jpeg, or (3) image/pjpeg, then accessing it via a direct request to the file under pictures/.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.033 (87.1th percentile) — read the EPSS interpretation.

Affected products

  • Phpmotion — versions 1.0
  • N/a — versions n/a

Weakness classification (CWE)

References