Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The updateFile function in inc/core/class.dc.media.php in the Media Manager in Dotclear before 2.2.3 does not properly restrict pathnames, which allows remote authenticated users to upload and execute arbitrary PHP code via the media_path or media_file parameter. NOTE: some of these details are obtained from third party information.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Dotclear Media Manager updateFile函数任意文件上传漏洞
Vulnerability Description
Dotclear是软件开发者Olivier Meunier所研发的一套免费的基于PHP和MySQL的博客（Blog）发布软件。 Dotclear 2.2.3之前版本中存在任意文件上传漏洞。该漏洞源于的Media Manager的inc/core/class.dc.media.php中的updateFile函数没有正确验证所上传文件的类型，远程认证用户可以借助media_path或media_file参数上传任意文件并执行任意PHP代码。
CVSS Information
N/A
Vulnerability Type
N/A