CVE:CVE-2007-0505
CNNVD:CNNVD-200701-453
Drupal项目事件追踪模块20070123之前的4.7.0到5.x版本中存在未限制文件上传漏洞。远程认证用户可以附加一个带有可执行性或多个扩展名的文件到项目事件，来执行任意代码。
solution:Upgrade drupal project to a higher version than 4.6,4.6_1.1,4.7,4.7_1.1,4.7_2.1,5.0,and avoid the version 4.6,4.6_1.1,4.7,4.7_1.1,4.7_2.1,5.0; Upgrade drupal project_issue_tracking_module to a higher version than 4.7,4.7_1.1,4.7_2.1,5.0,and avoid the version 4.7,4.7_1.1,4.7_2.1,5.0