PT-2007-3368 · Phpwiki · Phpwiki

Reini Urban · Publicado 2007-04-13 · Atualizado 2018-10-16 · CVE-2007-2024

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PhpWiki versions 1.3.x

Description The issue concerns an unrestricted file upload vulnerability in the UpLoad feature, specifically in the lib/plugin/UpLoad.php file. This allows remote attackers to upload arbitrary PHP files with various extensions, including php3, php4, or php5.

Recommendations For PhpWiki versions 1.3.x, restrict access to the UpLoad feature in lib/plugin/UpLoad.php to prevent arbitrary file uploads until a patch is available. Consider temporarily disabling the UpLoad feature as a mitigation measure to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-2024

DSA-1371-1

Produtos afetados

Phpwiki

Referências · 12

• http://kb.cert.org/vuls/id/914793 · Nota
• http://debian.org/security/2007/dsa-1371 · Aviso do Fabricante
• http://securityfocus.com/archive/1/465550/100/0/threaded · Nota
• http://vupen.com/english/advisories/2007/1400 · Nota
• http://nabble.com/Fwd%3A-Critical-phpwiki-c99shell-exploit-t3571197.html · Nota
• http://gentoo.org/security/en/glsa/glsa-200705-16.xml · Aviso do Fabricante
• http://secunia.com/advisories/25307 · Nota
• http://secunia.com/advisories/26784 · Nota
• http://securityfocus.com/archive/1/465514/100/0/threaded · Nota
• http://securityfocus.com/archive/1/465489/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2024 · Nota de Segurança
• http://secunia.com/advisories/24888 · Aviso do Fabricante