I got bitten by this too, and when I discovered why I was livid.

https://svn.openx.org/openx/tags/2.8/openx-2.8.6/plugins_rep...

This third party plugin is automatically installed and enabled by the installer. No admin authentication, wide open access to upload and run PHP.

More details can be found at http://www.kreativrauschen.com/blog/2010/09/09/critical-vuln... and if www/admin/plugins/videoReport/lib/tmp-upload-images/ exists, it's likely your server has been compromised.