Vulnerability title: Arbitrary File Upload In ProjeQtor
CVE: Not yet assigned
Affected version: 4.5.2
Fixed version: 4.5.3
Reported by: Arturo Rodriguez
It was discovered that authenticated users were able to upload files with extensions: php3, php4, php5 or phtml to the web server.
As a project member, go to Tickets > Create a new ticket > attach a php5 file and then go to http://<<projeqtorpath>>/files/attach/attachement_<<id>>/<<filename>>.php5 to execute the php code.
An attacker could exploit the functionality to upload server scripts which, when requested by a browser, would execute code on the server.