CVE-2023-53952

EIP tracks 1 public exploit for CVE-2023-53952. PoCs published by Mirabbas Ağalarov.

AI-analyzed exploit summary This exploit demonstrates an authenticated RCE vulnerability in Dotclear 2.25.3 by uploading a malicious PHAR file disguised as an image, which executes arbitrary PHP code when accessed.

Dotclear 2.25.3 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension through the blog post creation interface. Attackers can upload files containing PHP system commands that execute when the uploaded file is accessed, enabling arbitrary code execution on the server.