Description
serendipity_moveMediaDirectory in Serendipity 2.0.3 allows remote attackers to upload and execute arbitrary PHP code because it mishandles an extensionless filename during a rename, as demonstrated by "php" as a filename.
Remediation
References
Related Vulnerabilities
phpMyAdmin Other Vulnerability (CVE-2005-2869)
phpMyAdmin Improper Restriction of XML External Entity Reference Vulnerability (CVE-2011-4107)
Apache HTTP Server Heap-based Buffer Overflow Vulnerability (CVE-2026-42536)
WordPress Plugin Ocean Extra Cross-Site Request Forgery (1.6.5)
WordPress Plugin JoomSport-for Sports: Team & League, Football, Hockey & more SQL Injection (3.3)