CVE-2005-2733: Simple PHP Blog upload_img_cgi.php unrestricted file extension upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityUnauthenticated remote code execution via file upload with a high EPSS score, though the record is old and lacks a confirmed fixed version or public exploit tag.

What it is

upload_img_cgi.php in Simple PHP Blog (SPHPBlog) fails to properly restrict the file extensions of uploaded files. Because uploaded files are not validated against a safe extension list, an attacker can upload a script that the web server may then execute. This is a remote, unauthenticated code execution risk in a web-facing blog application.

Impact

An attacker can upload a file with an executable extension and, if the upload directory is web-accessible and script execution is enabled there, run arbitrary code with the web server's privileges. That yields full compromise of the blog host rather than just data exposure.

Attack surface

Reached over the network through the upload_img_cgi.php upload endpoint; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. The description does not state whether the endpoint is otherwise gated, so treat it as directly reachable.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is 0.51169 (98.9th percentile), indicating a high modeled likelihood of exploitation activity. Reference tags include only a Vendor Advisory, with no public exploit tag supplied.

What to do

• Apply the vendor fix or upgrade Simple PHP Blog to a release that validates uploaded file extensions; if no fixed release exists, remove or disable the application.
• Restrict upload_img_cgi.php so only authenticated, trusted users can upload files.
• Enforce a strict allowlist of image extensions and reject double extensions, null bytes and executable types such as .php, .phtml, .php5 and .phar.
• Store uploaded files outside the web root, or configure the web server to serve the upload directory without script execution.
• Add a web application firewall rule blocking uploads whose filenames or content indicate executable scripts.

Detection

• Review web server and application logs for POST requests to upload_img_cgi.php followed by requests to files in the upload directory.
• Alert on newly created files in upload or image directories whose extensions are executable or not in the expected image set.
• Monitor for outbound connections or child processes spawned by the web server user shortly after an upload event.
• Search the filesystem for script files containing upload-related or webshell indicators in the blog upload paths.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.