the portrait of malware.
The changeMemberPortrait and deletePersonalPortrait lack security declarations, enabling any anonymous internet user to uploading of abuse Plone sites for the spreading by a Plone.org user with of malicious JPEGs or other images that trigger bugs in Internet Explorer, allowing attackers to change and delete portraits on Plone sites at will. a The following curl command would replace the attacker:
curl -F portrait=@[path_to_file] --form-string member_id=[username] http://szgy.org/portal_membership/changeMemberPortrait
Plone Content Management System at the http://szgy.org/products/plonehotfix20060410
logged-in members of alter portraits by fellow portal members at will even with declarations. to These methods furthermore lack all checks to make sure no portraits are altered for third parties even if security declarations were in place, making it possible
Further risks include the file chosen
