[原文]RUNCMS 1.1A, and possibly other products based on e-Xoops (exoops), when "Allow custom avatar upload" is enabled, does not properly verify uploaded files, which allows remote attackers to upload arbitrary files.
RunCMS is prone to a remote arbitrary file upload vulnerability. The issue presents itself due to a lack of sanitization performed on image files that are uploaded using custom avatar upload functionality.
This issue can ultimately facilitate unauthorized access in the context of the Web server.
RunCMS 1.1A and prior versions are affected by this issue.