Command injection

The Image Manager in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to rename arbitrary files and cause a denial of service via modified fileNewFilename, fileNewFiletmpname, and fileNewFilesize parameters in a FileUpload command, which are used to modify equivale...