Arbitrary File Upload and Remote Code Execution in YaPiG 0.92b, 0.93u, and 0.94u

CVE-2005-1881 · HIGH Severity

AV:N/AC:L/AU:N/C:P/I:P/A:P

upload.php in YaPiG 0.92b, 0.93u and 0.94u does not properly restrict the file extension for uploaded image files, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code.

Learn more about our Api Penetration Testing.