Vulnerability in phpWebSite Announcement Image Upload
Please note that we do not support phpWebSite. This news item is for IU's central web server account holders who are using phpWebSite on their account.
A security researcher known as nst has reported a vulnerability in phpWebSite, which potentially can be exploited by malicious people to compromise a vulnerable system.
The vulnerability is caused due to an error in the uploading of images when submitting an announcement. This can be exploited to upload arbitrary PHP scripts to a directory inside the web root. The vulnerability has been reported in version 0.10.0 and prior. This vulnerability in phpWebSite currently lacks a patch, but can be resolved by editing source code to ensure filenames of uploaded images are properly verified.
For more information, please see Secunia Advisory: phpWebSite Announcement Image Upload Vulnerability
