CVE-2016-7902
HighSummary
In Dotclear before version 2.10.3, there is an unrestricted file upload vulnerability in the fileUnzip->unzip method that allows remote authenticated users with permissions to manage media items to execute arbitrary code by uploading a ZIP file containing a file with a crafted extension.
Risk Assessment
This vulnerability could lead to remote code execution, posing a serious threat to the security of the system and the organization's data.
Recommendation
It is recommended to update Dotclear to version 2.10.3 or later to mitigate this vulnerability and to restrict user permissions for managing media items.
Other vulnerabilities in Dotclear
See all- CVE-2015-8832High
Multiple incomplete blacklist vulnerabilities in Dotclear before version 2.8.2 allow remote authenticated users with permissions to manage their own media items and entries/comments to execute arbitrary PHP code by uploading a file with a .pht, .phps, or .phtml extension.
- CVE-2016-9268High
In Dotclear versions up to 2.10.4, there is an unrestricted file upload vulnerability in the 'Install or upgrade manually' module that allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with a zip extension.
- CVE-2014-1613High
Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dc_passwd cookie to a password-protected page, which is not properly handled by inc/public/lib.urlhandlers.php or plugins/pages/_public.php.
Original NVD description (English source)
Unrestricted file upload vulnerability in the fileUnzip->unzip method in Dotclear before 2.10.3 allows remote authenticated users with permissions to manage media items to execute arbitrary code by uploading a ZIP file containing a file with a crafted extension, as demonstrated by .php.txt or .php%20.