CVE-2015-8832

HIGH

dotclear < 2.8.1 - Authenticated Arbitrary PHP Code Execution via File Upload

Title source: llm

Description

Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own media items" and "manage their own entries and comments" permissions to execute arbitrary PHP code by uploading a file with a (1) .pht, (2) .phps, or (3) .phtml extension.

References (8)

Core 8

Core References

Mailing List, Patch, Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2016/03/05/4

Release Notes, Vendor Advisory x_refsource_confirm

http://dotclear.org/blog/post/2015/10/25/Dotclear-2.8.2

Exploit, Mailing List, Patch, Third Party Advisory mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2015/Nov/58

Exploit, Patch, Third Party Advisory x_refsource_misc

http://packetstormsecurity.com/files/134352/dotclear-2.8.1-Shell-Upload.html

Issue Tracking, Patch, Vendor Advisory x_refsource_confirm

https://hg.dotclear.org/dotclear/rev/198580bc3d80

Mailing List, Patch, Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2016/03/07/5

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/96379

Exploit, Patch, Third Party Advisory x_refsource_misc

https://blog.curesec.com/article/blog/dotclear-281-Code-Execution-93.html

Scores

CVSS v3 8.8

EPSS 0.0259

EPSS Percentile 83.4%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-284

Status published

Products (1)

dotclear/dotclear < 2.8.1

Published Feb 09, 2017

Tracked Since Feb 18, 2026