Dotclear Multiple Vulnerabilities

Dotclear is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:dotclear:dotclear"; ifdescription...

Dotclear 2.6.2 Multiple Vulnerability

Dotclear versions 2.6.2 and below suffer from a remote SQL injection, remote shell upload Dotclear 2.6.2 SQL Injection Vulnerability - Affected Versions: Version 2.6.2 and probably prior versions. - Vulnerability Description: The vulnerable code is located in /admin/categories.php: 70. Update ord...

CVE-2014-3783

SQL injection vulnerability in admin/categories.php in Dotclear before 2.6.3 allows remote authenticated users with the manage categories permission to execute arbitrary SQL commands via the categoriesorder parameter...

Sql injection

SQL injection vulnerability in admin/categories.php in Dotclear before 2.6.3 allows remote authenticated users with the manage categories permission to execute arbitrary SQL commands via the categoriesorder parameter...

CVE-2014-3783

SQL injection vulnerability in admin/categories.php in Dotclear before 2.6.3 allows remote authenticated users with the manage categories permission to execute arbitrary SQL commands via the categoriesorder parameter...

CVE-2014-3783

SQL injection vulnerability in admin/categories.php in Dotclear before 2.6.3 allows remote authenticated users with the manage categories permission to execute arbitrary SQL commands via the categoriesorder parameter...

CVE-2014-3783

Dotclear 2.6.2 and earlier suffer an SQL injection in admin/categories.php via the categories_order POST parameter. The vulnerability arises because input from $_POST['categories_order'] is not properly sanitized before being passed to dcBlog::updCategoryPosition, which calls nestedTree::updatePo...

Dotclear 2.6.2 Authentication Bypass

------------------------------------------------------------------------- Dotclear core-auth-userID == $userid 267. return true; 268. 269. 270. if $this-core-auth-checkUser$userid,$pwd !== true 271. throw new Exception'Login error'; 272. 273. 274. return true; The vulnerability exists because of...

Dotclear Media Manager Authenticated Arbitrary File Upload

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'dotclear Media Manager Authenticated Arbitrary File Upload', 'Description' = %q The vulnerability exists because of the...

Dotclear 2.6.2 Arbitrary File Upload

------------------------------------------------------------------------ Dotclear = 2.6.2 Media Manager Unrestricted File Upload Vulnerability ------------------------------------------------------------------------ - Software Link: http://dotclear.org/ - Affected Versions: Version 2.6.2 and...

Dotclear 2.6.2 SQL Injection

-------------------------------------------------------------- Dotclear itemid 76. $core-blog-updCategoryPosition$category-itemid, $category-left, $category-right; 77. 78. 79. 80. dcPage::addSuccessNotice'Categories have been successfully reordered.'; 81. http::redirect'categories.php'; 82. User...

CVE-2014-1613

Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dcpasswd cookie to a password-protected page, which is not properly handled by 1 inc/public/lib.urlhandlers.php or 2 plugins/pages/public.php...

Default credentials

Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dcpasswd cookie to a password-protected page, which is not properly handled by 1 inc/public/lib.urlhandlers.php or 2 plugins/pages/public.php...

CVE-2014-1613

Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dcpasswd cookie to a password-protected page, which is not properly handled by 1 inc/public/lib.urlhandlers.php or 2 plugins/pages/public.php...

CVE-2014-1613

Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dcpasswd cookie to a password-protected page, which is not properly handled by 1 inc/public/lib.urlhandlers.php or 2 plugins/pages/public.php...

CVE-2014-1613

Dotclear vulnerable before 2.6.2: a serialized object in the dc_passwd cookie can trigger remote PHP code execution via untrusted handling in inc/public/lib.urlhandlers.php or plugins/pages/_public.php. Affected: Dotclear 2.x

Dotclear 2.5 Cross Site Scripting

Exploit Title: Dotclear 2.5 Cms Cross Site Scripting Vulnerabilities Date: 06/04/2013 Author: Nikhalesh Singh Bhadoria Twitter: @nikhaleshsingh Download Link:http://dotclear.org/ Versions Affected: Dotclear 2.5. Category:Xss...

XSS and CS vulnerabilities in Dotclear

Hello 3APA3A! These are Cross-Site Scripting and Content Spoofing vulnerabilities in Dotclear. CMS Dotclear has three vulnerable flash-files: swfupload.swf, playerflv.swf and playermp3.swf. File swfupload.swf it's Swfupload. I've wrote about vulnerabilities in Swfupload in November 2012...

Vulnerabilities in SWFUpload in multiple web applications: WordPress, Dotclear, InstantCMS, AionWeb and others

Hello 3APA3A! Earlier I've wrote about Content Spoofing and Cross-Site Scripting vulnerabilities in SWFUpload http://securityvulns.ru/docs29181.html. This is very popular flash-file, which is used at tens millions of web sites and in hundreds of web applications only WordPress is used at more the...

Dotclear XSS Vulnerabilities

These are Cross-Site Scripting and Content Spoofing vulnerabilities in Dotclear. These are Cross-Site Scripting and Content Spoofing vulnerabilities in Dotclear. CMS Dotclear has three vulnerable flash-files: swfupload.swf, playerflv.swf and playermp3.swf. File swfupload.swf it's Swfupload. I've...