mallbuilder foreground arbitrary file deletion vulnerability

MallBuilder is a multi-user online shopping mall solution based on PHP + MYSQL. An arbitrary file deletion vulnerability exists in the frontend of mallbuilder. Due to lib/smarty/movepic.php in the $GET'pname' external incoming parameters are not filtered, as a controllable parameter, when type =...