Title: Phlatline's Personal Information Manager (pPIM) upload.php File Upload Arbitrary Code Execution
Aug 11, 2008
Phlatine's Personal Information Manager (pPIM) contains a flaw that may allow a remote attacker to execute arbitrary code. The issue is due to the 'upload.php' script allowing the upload of files with arbitrary extensions to a folder inside the webroot. This may allow an attacker to upload arbitrary files, and for example, execute arbitrary PHP code.
Remote / Network Access
Loss of Integrity
OSVDB is not aware of a solution for this vulnerability.