CVE-2014-3782

Published: Jun 11, 2014Modified: May 6, 2026

6.0

Vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Exploitability: 6.8 / Impact: 6.4

Source: NVD

Description

Multiple incomplete blacklist vulnerabilities in the filemanager::isFileExclude method in the Media Manager in Dotclear before 2.6.3 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) double extension or (2) .php5, (3) .phtml, or some other PHP file extension.

Affected (4)

Products: Dotclear: Dotclear

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Dotclear Dotclear	Up to 2.6.2
Dotclear Dotclear	Version 2.6.1
Dotclear Dotclear	Version 2.6
Dotclear Dotclear	Version 2.6 rc

References (12)

http://dotclear.org/blog/post/2014/05/16/Dotclear-2.6.3

Source: cve@mitre.org

Vendor Advisory

http://karmainsecurity.com/KIS-2014-06

Source: cve@mitre.org

http://seclists.org/fulldisclosure/2014/May/108

Source: cve@mitre.org

http://seclists.org/fulldisclosure/2014/May/116

Source: cve@mitre.org

http://seclists.org/fulldisclosure/2014/May/122

Source: cve@mitre.org

http://secunia.com/advisories/58675

Source: cve@mitre.org

http://dotclear.org/blog/post/2014/05/16/Dotclear-2.6.3

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://karmainsecurity.com/KIS-2014-06

Source: af854a3a-2127-422b-91ae-364da2661108

http://seclists.org/fulldisclosure/2014/May/108

Source: af854a3a-2127-422b-91ae-364da2661108

http://seclists.org/fulldisclosure/2014/May/116

Source: af854a3a-2127-422b-91ae-364da2661108

http://seclists.org/fulldisclosure/2014/May/122

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/58675

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.