CVE-2015-6968

Multiple incomplete blacklist vulnerabilities in the serendipity_isActiveFile function in include/functions_images.inc.php in Serendipity before 2.0.2 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .pht or (2) .phtml extension.

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

2.07% chance of exploitation in the next 30 days, 80th percentile

Published

2015-09-16

Updated

2024-09-16

Proof-of-concept exploits (1)

• http://seclists.org/fulldisclosure/2015/Sep/6

References

• CVE Record
• NVD entry

Related

• CVE-2015-6967
• CVE-2015-6969
• CVE-2015-6965
• CVE-2015-6970
• CVE-2015-6962
• CVE-2015-6972