actually this bug seems to be fixed long time ago by adding following code
to the EZform.php
----
if (is_null($allowedImages) || !is_array($allowedImages)) {
include(PHPWS_SOURCE_DIR.'conf/allowedImageTypes.php');
$allowedImages =3D $allowedImageTypes;
}

$fileTypes =3D implode(", ", $allowedImages);

if (!in_array($_FILES[$postVar]["type"], $allowedImages)){
$error =3D new PHPWS_Error("EZform", "saveImage", "Submitted image
must be $fileTypes file.");
return $error;
}
----

code of the allowedImageTypes.php
----

<?php

/* Image types which are allowed to be uploaded via phpwebsite modules */
/* Added 12/03/2003 (might not be implemented in all modules yet */

$allowedImageTypes =3D array("image/jpeg",
"image/jpg",
"image/pjpeg",
"image/png",
"image/x-png",
"image/gif",
"image/wbmp");

?>
----

--- Urspr=FCngliche Nachricht ---
Datum: 24.02.2005 23:16
Von: tjomka <tjomka@navigator.lv>
An: bugtraq@securityfocus.com
Betreff: phpWebSite-0.10.0_exploit

> phpWebSite-0.10.0_exploit
>