Description

Unrestricted file upload vulnerability in the CWebContact::doModel method in oc-includes/osclass/controller/contact.php in OSClass before 3.4.3 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in an unspecified directory.

Remediation

References

CVE-2014-8085

Related Vulnerabilities

Apache Tomcat Other Vulnerability (CVE-2007-1858)

GlassFish Improper Authentication Vulnerability (CVE-2017-1000030)

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-14631)

WordPress 4.4.x Multiple Vulnerabilities (4.4 - 4.4.6)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2014-9705)

Severity

Medium

Classification

CVE-2014-8085

Tags

Missing Update Known Vulnerabilities