Secunia Research has discovered a vulnerability in X2CRM, which can be exploited by malicious users to compromise a vulnerable system.
The vulnerability is caused due to the ProfileController::actionUploadPhoto() method defined in the
/protected/controllers/ProfileController.php script allowing the upload of files with arbitrary extensions to a folder inside the webroot. This can be exploited to execute arbitrary PHP code by uploading a malicious PHP script.
The vulnerability is confirmed in versions 3.7.3, 3.7.4, and 3.7.5. Other versions may also be affected.
