Description

Unrestricted file upload vulnerability in the CWebContact::doModel method in oc-includes/osclass/controller/contact.php in OSClass before 3.4.3 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in an unspecified directory.

Remediation

References

CVE-2014-8085

Related Vulnerabilities

Drupal Core 9.2.x Directory Traversal (9.2.0 - 9.2.1)

WordPress Plugin Dynamic Content for Elementor Remote Code Execution (1.9.5.6)

Squid Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2019-12854)

WordPress Plugin P3 (Plugin Performance Profiler) Cross-Site Scripting (1.5.3.8)

WordPress Plugin Quick Cache (Speed Without Compromise) Unspecified Vulnerability (140725)

Severity

Medium

Classification

CVE-2014-8085

Tags

Missing Update Known Vulnerabilities