CVE-2011-5134

https://notcve.org/view.php?id=CVE-2011-5134

Unrestricted file upload vulnerability in editor/extensions/browser/file.php in the JCE component before 2.0.18 for Joomla! allows remote authenticated users with the author privileges to execute arbitrary PHP code by uploading a file with a double extension, as demonstrated by .php.gif. NOTE: some of these details are obtained from third party information. Vulnerabilidad de carga de ficheros no restringida en editor/extensions/browser/file.php en el componente JCE anterior a v2.0.18 para Joomla! permite a usuarios remotos autenticados con privilegios de autor ejecutar código arbitrario PHP a través de la carga de un fichero con una extensión doble, como se demuestra con .php.gif. • http://secunia.com/advisories/47190 http://www.joomlacontenteditor.net/news/item/jce-2018-released?category_id=32 http://www.osvdb.org/77579 •