bugtraq - Dotclear 'ecrire/images.php' Arbitrary File Upload Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 15 Apr 2008 10:51:40 +0200
From: Morgan ARMAND <armand_m@...tech.net>
To: bugtraq@...urityfocus.com
Subject: Dotclear 'ecrire/images.php' Arbitrary File Upload Vulnerability

#####################################################################

Advisory #1 "Dotclear 'ecrire/images.php' Arbitrary File Upload 
Vulnerability"

$ Author : Morgan ARMAND
$ Contact : armand_m at epitech dot net
$ Vendor URL : http://www.dotclear.net
$ Vendor Contacted : 07/04/2008
$ Vendor Status : No response
$ Affected Software : Dotclear <= 1.2.7.1
$ Severity : Medium / Critical

#####################################################################

Vulnerability:

Dotclear is prone to an arbitrary script upload vulnerability.

The vulnerability is caused due to missing validation of the file extension.

If successfully exploited, an attacker can execute arbitrary script code 
on a vulnerable server.
You need to have an account in order to access to the vulnerable page.

All versions of Dotclear are considered vulnerable at the moment.