CVE-2005-1881

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

upload.php in YaPiG 0.92b, 0.93u and 0.94u does not properly restrict the file extension for uploaded image files, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/15600/Broken Link, Vendor Advisory
http://securitytracker.com/id?1014103Broken Link, Exploit, Third Party Advisory, VDB Entry, Vendor Advisory
http://secwatch.org/advisories/secwatch/20050530_yapig.txtBroken Link, Vendor Advisory
http://www.osvdb.org/17115Broken Link, Vendor Advisory
http://secunia.com/advisories/15600/Broken Link, Vendor Advisory
http://securitytracker.com/id?1014103Broken Link, Exploit, Third Party Advisory, VDB Entry, Vendor Advisory
http://secwatch.org/advisories/secwatch/20050530_yapig.txtBroken Link, Vendor Advisory
http://www.osvdb.org/17115Broken Link, Vendor Advisory

Timeline

Published: Jun 6, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-18827.5PHP remote file inclusion vulnerability in last_gallery.php in YaPiG 0.93u and 0.94u allows remote attackers to execute arbitrary PHP code v CVE-2005-18835.0global.php in YaPiG 0.92b allows remote attackers to include arbitrary local files via the BASE_DIR parameter.CVE-2005-18846.4Directory traversal vulnerability in the (1) rmdir or (2) mkdir commands in upload.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attacke CVE-2005-18855.0view.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attackers to obtain sensitive information via a phid parameter that is not an integer CVE-2005-18864.3Cross-site scripting (XSS) vulnerability in view.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attackers to inject arbitrary web script CVE-2005-18874.6Unknown vulnerability in the Sun Solaris C library (libc and libproject) in Solaris 10 allows local users to gain privileges.CVE-2005-18884.3Cross-site scripting (XSS) vulnerability in MediaWiki before 1.4.5 allows remote attackers to inject arbitrary web script via HTML attribute CVE-2005-18895.0Unknown vulnerability in Sun ONE Application Server 6.5 SP1 Maintenance Update 6 and earlier allows attackers to read files.CVE-2005-18905.0Unknown vulnerability in Mortiforo before 0.9.1 allows users to access private forums via unknown attack vectors.CVE-2005-18917.5The GIF parser in ateimg32.dll in AOL Instant Messenger (AIM) 5.9.3797 and earlier allows remote attackers to cause a denial of service (cra CVE-2005-18926.4FlatNuke 2.5.3 allows remote attackers to cause a denial of service or obtain sensitive information via (1) a direct request to foot_news.ph CVE-2005-18935.0FlatNuke 2.5.3 allows remote attackers to obtain sensitive information via invalid parameters to certain scripts, which leaks the web docume