We have been having the same problem with a vbulletin integrated system. I finally found the renamed folders too.
Having spent the weekend hunting for file-system and shell commands in the software I found a problem in the handleupload() function in the image-inc.php file:
if ( !file_exists($newfilepath) ) {
@rename($filein, $newfilepath);
$realname = $newfile;
$dst_file = $newfilepath;
break;
}
If you upload a picture whose name is already used in that category, it tries adding 1, 2, 3, ... etc on to the end to find an available name. This is then checked by the !file_exists($newfilepath).
Once a valid name has been found it updates the variables and breaks out of the loop, in order to do a move_uploaded_file().
I think you will find that the directory names are all things line shoe1.jpg, shoe2.jpg, not shoe.jpg - as only happens when this code is being triggered.
The $realname = $newfile and $dst_file = $newfilepath are fine - just setting the right variables to copy the temporary file to the desired location.
But the @rename($filein, $newfilepath); is a problem.
It seems to be a poor copy from the bulk-upload function, where rename($filein,$newfile) is appropriately used in similar circumstances.
Here $filein is uninitialised in this routine, and the rename is to $newfilepath - the fully qualified path name e.g. ...\data\25\flower1.jpg or whatever instead of just the revised filename, flower1.jpg
In PHP 'rename' is quite capable of moving an entire directory structure, so here is a line that tries to move something undefined to the data directory, with a picture name file in the way people have found.
I suspect for some reason $filein is ending up referring to the base forum directory (perhaps depending on end slashes in the config-intc.php or other issues). So we end up with the effect of moving forum to data\25\flower1.jpg
Certainly a rogue command that is trying to move something to exactly the right place looks like a good candidate. and iIf I am right, the solution is simple - just delete the @rename. It is not needed at all.
I will find out today when the hosts take off the heavily permissions we have been using to stop the forum going down.
Even if this is not the cause of the problem it needs fixing. There is a big potential security hole here - I have been wondering whether I could get a ad to present non-picture info with some kind of
uploadproduct.php?filein="c:\wwwroot\secrets.txt" exploit
Regards
Erica
Seems to have fixed it... 
Linear Mode
