CVE-2006-2330

CVE-2006-2330 describes a file upload vulnerability in PHP-Fusion 6.00.306 and earlier versions, specifically when running on Apache HTTP Server with PHP 4.3.3. Authenticated attackers could bypass file type validation by using double extensions (e.g., ".php.gif") to upload and execute malicious PHP code embedded in files like avatars. This vulnerability carries a CVSS score of 6.4, indicating a medium severity. It is easily exploitable over the network with low attack complexity and no authentication required, potentially leading to partial compromise of confidentiality and integrity. While there is no evidence of active exploitation (KEV list), an ExploitDB entry exists (EDB-1760) detailing multiple vulnerabilities, including this one. There is minimal community discussion or media coverage surrounding this CVE.