STG Security Advisory: Discuz! does not properly check extensions of uploaded files, so malicious attackers can upload a file with multiple extensions such as attach.php.php.php.php.rar to a web server. This can be exploited to run arbitrary commands with the privilege of the HTTPD process, which is typically run as the nobody user. Versions 4.0.0 rc4 and prior are affected.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/39325/SSA-20050812-27.txt
Source: https://packetstormsecurity.com/files/39325/STG-Security-Advisory-2005-08-12.27.html