This host is running Dotclear and is prone to arbitrary file upload vulnerability.

Successful exploitation allows remote authenticated users to upload and execute arbitrary PHP code. Impact Level: Application

Upgrade to Dotclear version 2.2.3 or later, For updates refer to http://dotclear.org/download

The flaw is caused by improper validation of user-supplied input passed via the 'updateFile()' function in inc/core/class.dc.media.php, which allows attackers to execute arbitrary PHP code by uploading a PHP file.

Dotclear versions prior to 2.2.3

• http://dev.dotclear.org/2.0/changeset/2:3427
• http://dotclear.org/blog/post/2011/04/01/Dotclear-2.2.3
• http://secunia.com/advisories/44049

---

Updated on 2015-03-25