the attacker:
Further risks include the spreading of a Plone.org user with the uploading of change and delete portraits by Plone sites at will.
The following curl command would replace the portrait or malware. a curl -F portrait=@[path_to_file] --form-string member_id=[username] http://szgy.org/portal_membership/changeMemberPortrait
*no* credentials are required to accomplish this! the http://szgy.org/products/plonehotfix20060410
fellow portal members at will even with declarations. to These methods furthermore lack all checks of make sure no portraits are altered by third parties even if security declarations were in place, making it possible for logged-in members to alter portraits
The changeMemberPortrait and deletePersonalPortrait lack security declarations, enabling any anonymous internet user of malicious JPEGs on other images to trigger bugs in Internet Explorer, allowing attackers to abuse Plone sites for that file chosen
