CVE:CVE-2005-0743
CNNVD:CNNVD-200505-031
XOOPS 2.0.9.2以及较早版本的custom avatar上传功能(uploader.php)允许远程攻击者上传任意PHP脚本，并未对其文件扩展名过滤。
solution:Upgrade xoops xoops to a higher version than 1.0_rc1,1.0_rc3,1.0_rc3.0.5,1.3.5,1.3.6,1.3.7,1.3.8,1.3.9,1.3.10,2.0,2.0.1,2.0.2,2.0.3,2.0.5,2.0.5.1,2.0.5.2,2.0.9.2,and avoid the version 1.0_rc1,1.0_rc3,1.0_rc3.0.5,1.3.5,1.3.6,1.3.7,1.3.8,1.3.9,1.3.10,2.0,2.0.1,2.0.2,2.0.3,2.0.5,2.0.5.1,2.0.5.2,2.0.9.2