PT-2007-3369 · Apache+1 · Apache+1

Harold Hallikainen · Publicado 2007-04-13 · Atualizado 2008-09-05 · CVE-2007-2025

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PhpWiki version 1.3.11p1

Description The issue concerns an unrestricted file upload vulnerability in the UpLoad feature, specifically in the lib/plugin/UpLoad.php file. This allows remote attackers to upload arbitrary PHP files, potentially by using a double extension, which can be interpreted by Apache as a valid PHP file.

Recommendations For PhpWiki version 1.3.11p1, consider restricting or disabling the UpLoad feature in lib/plugin/UpLoad.php until a proper fix is available to prevent the upload of arbitrary PHP files.

Correção

Identificadores relacionados

CVE-2007-2025

DSA-1371-1

Produtos afetados

Apache

Phpwiki

Referências · 7

• http://nabble.com/Important-UpLoad-security-fix%21-was--Fwd%3A--phpwiki---Open-Discussion--RE%3A-upload-security-risk--t3543463.html · Nota
• http://gentoo.org/security/en/glsa/glsa-200705-16.xml · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-2025 · Nota de Segurança
• http://debian.org/security/2007/dsa-1371 · Aviso do Fabricante
• http://secunia.com/advisories/25307 · Nota
• http://secunia.com/advisories/26784 · Nota
• https://sourceforge.net/forum/message.php?msg_id=4249177 · Nota