CVE-2001-1020

editimage.php in Vibechild Directory Manager before 0.91 allows remote attackers to execute arbitrary commands via shell metacharacters in the userfilename parameter, which is sent unfiltered to the PHP passthru function...