CVE ID:	CVE-2007-1639
Description:	Unrestricted file upload vulnerability in PHProjekt 5.2.0, when magic_quotes_gpc is disabled, allows remote authenticated users to upload and execute arbitrary PHP code via a file with an executable extension, which is then accessed by the (1) calendar or (2) file management module, or possibly unspecified other files.
Test IDs:	None available
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2007-1639 BugTraq ID: 22956 http://www.securityfocus.com/bid/22956 Bugtraq: 20070314 n.runs-SA-2007.006 - PHProjekt 5.2.0 - Privilege escalation (Google Search) http://www.securityfocus.com/archive/1/462785/100/100/threaded http://security.gentoo.org/glsa/glsa-200706-07.xml http://www.nruns.de/security_advisory_phprojekt_privilege_escalation.php http://osvdb.org/35163 http://secunia.com/advisories/24509 http://secunia.com/advisories/25748 http://securityreason.com/securityalert/2476 XForce ISS Database: phprojekt-calendarfile-file-upload(32995) https://exchange.xforce.ibmcloud.com/vulnerabilities/32995