CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 7.5
CWE Name:  Permissions Privileges and Access Controls
Summary: admin/uploadgames.php in myspace content zone (mcz) 3.x does not require administrative privileges, which allows remote attackers to perform unrestricted file uploads, as demonstrated by uploading (1) a .php file and (2) a .php%00.jpeg file.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2008-01-08
Last Modified Date: 2017-10-19