Home page logo
/

bugtraq logo Bugtraq mailing list archives

Dotclear 'ecrire/images.php' Arbitrary File Upload Vulnerability
From: Morgan ARMAND <armand_m () epitech net>
Date: Tue, 15 Apr 2008 10:51:40 +0200

#####################################################################

Advisory #1 "Dotclear 'ecrire/images.php' Arbitrary File Upload Vulnerability"

$ Author : Morgan ARMAND
$ Contact : armand_m at epitech dot net
$ Vendor URL : http://www.dotclear.net
$ Vendor Contacted : 07/04/2008
$ Vendor Status : No response
$ Affected Software : Dotclear <= 1.2.7.1
$ Severity : Medium / Critical

#####################################################################

Vulnerability:

Dotclear is prone to an arbitrary script upload vulnerability.

The vulnerability is caused due to missing validation of the file extension.

If successfully exploited, an attacker can execute arbitrary script code on a vulnerable server.
You need to have an account in order to access to the vulnerable page.

All versions of Dotclear are considered vulnerable at the moment.



  By Date           By Thread  

Current thread:
  • Dotclear 'ecrire/images.php' Arbitrary File Upload Vulnerability Morgan ARMAND (Apr 15)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault