Vulnerability Description
Dotclear 2.25.3 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension through the blog post creation interface. Attackers can upload files containing PHP system commands that execute when the uploaded file is accessed, enabling arbitrary code execution on the server.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Dotclear | Dotclear | 2.25.3 |
Related Weaknesses (CWE)
References
- https://dotclear.org/Product
- https://www.exploit-db.com/exploits/51353ExploitThird Party AdvisoryVDB Entry
- https://www.vulncheck.com/advisories/dotclear-authenticated-remote-code-executioThird Party AdvisoryExploit
FAQ
What is CVE-2023-53952?
CVE-2023-53952 is a vulnerability with a CVSS score of 8.8 (HIGH). Dotclear 2.25.3 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension through the blog post creation interface. Attacker...
How severe is CVE-2023-53952?
CVE-2023-53952 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-53952?
Check the references section above for vendor advisories and patch information. Affected products include: Dotclear Dotclear.