返回 CVE 瀏覽器

CVE-2011-5083

HIGH

7.5

CVSS Severity Score

EPSS Score0.0240%

EPSS Percentile13.11th

Published2012年3月19日

Last Modified2026年4月29日

Vulnerability Description

Unrestricted file upload vulnerability in inc/swf/swfupload.swf in Dotclear 2.3.1 and 2.4.2 allows remote attackers to execute arbitrary code by uploading a file with an executable PHP extension, then accessing it via a direct request to the file in an unspecified directory.

Affected Platforms (CPE)

📦

Dotclear

Dotclear

= 2.3.1

📦

Dotclear

Dotclear

= 2.4.2

References & Advisories

🔗 http://cxsecurity.com/issue/WLB-2011090012

🔗 http://vigilance.fr/vulnerability/Dotclear-file-upload-via-swfupload-swf-11396

🔗 http://www.exploit-db.com/exploits/18529

🔗 http://www.osvdb.org/79665

🔗 http://www.securityfocus.com/bid/52173

🔗 http://cxsecurity.com/issue/WLB-2011090012

🔗 http://vigilance.fr/vulnerability/Dotclear-file-upload-via-swfupload-swf-11396

🔗 http://www.exploit-db.com/exploits/18529

相關漏洞威脅

CVE-2005-395710.0

Unspecified vulnerability in the Trackback functionality in DotClear 1.2.1 has unknown impact and attack vectors.

CVE-2008-32329.3

Unrestricted file upload vulnerability in ecrire/images.php in Dotclear 1.2.7.1 and earlier allows remote authenticated users to e...

CVE-2015-88328.8

Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated us...

CVE-2016-79028.8

Unrestricted file upload vulnerability in the fileUnzip->unzip method in Dotclear before 2.10.3 allows remote authenticated users ...