Items Manager - ver: 1.4

[shawn_a]

Sorry if it's already been linked to but it seems this plugin hasn't been patched for this vulnerability yet:

GetSimple Items Manager Arbitrary File Upload Vulnerability

Edit: Maybe just a Deny from All .htaccess in the server folder will be enough, otherwise the old <?php if(!defined('IN_GS')){ die('You cannot load this page directly.'); } ?> at the top might be the go too. Hard to say without looking at it closer.

No those aren't valid solutions,
This file is appears to be publicly accessible, with no security. It needs auth checks, and file extension filters.
Having it on your server is a vulnerability, add a quick login check to it or something in the meantime or remove it completely.

Also you should have .htaccess rules in your uploads and thumbs folder that are something other that allow all. Something like a filtype filter and a no exec one. To at least limit the public execution of a payload.