Avaya IP Office is a unified communications solution for mobile workforce.
The ImageUpload.ashx script allows unauthenticated users to upload arbitrary script files to the webserver. The script files can then be executed by a web request, leading to arbitrary command execution.
Apply one of the fixes referenced in ASA-2012-222.
Exploit works on Avaya IP Office Customer Call Reporter 18.104.22.168.