PHP remote file inclusion vulnerability in layout/prepend.php in DotClear 1.2.4 and earlier allows remote attackers to execute arbitrary PHP code via a FTP URL in the blog_dc_path parameter, which passes file_exists() and is_dir() tests on PHP 5.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Dotclear | Dotclear | 1.2.1 (including) | 1.2.1 (including) |
| Dotclear | Dotclear | 1.2.2 (including) | 1.2.2 (including) |
| Dotclear | Dotclear | 1.2.3 (including) | 1.2.3 (including) |
| Dotclear | Dotclear | 1.2.4 (including) | 1.2.4 (including) |