iScripts EasyCreate is a private label online website builder. This software allows you to start an online business by offering website building services to your customers. Equipped with drag and drop design functionality, crisp templates and social sharing capabilities, this online website builder software will allow you to provide the best website building features to your users.
iScripts EasyCreate suffers from an authenticated arbitrary PHP code execution. The vulnerability is caused due to the improper verification of uploaded files in '/ajax_image_upload.php' script thru the 'userImages' POST parameter. This can be exploited to execute arbitrary PHP code by uploading a malicious PHP script file with '.php4' extension (to bypass the '.htaccess' block rule) that will be stored in '/uploads/siteimages/thumb/' directory.