PT-2007-6675 · Tikiwiki · Tikiwiki

Publicado 2007-10-26 · Atualizado 2012-10-24 · CVE-2007-5684

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TikiWiki versions 1.9.8.1 and earlier

Description The issue allows remote attackers to include and execute arbitrary files. This can be achieved via absolute pathnames in the error handler file and local php parameters to "tiki-index.php", or through encoded "..%2F" sequences in the imp language parameter to "tiki-imexport languages.php".

Recommendations For TikiWiki versions 1.9.8.1 and earlier, consider disabling access to the tiki-index.php and tiki-imexport languages.php scripts until a fix is available. Restrict the use of the error handler file and local php parameters in "tiki-index.php" and the imp language parameter in "tiki-imexport languages.php" to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2007-5684

Produtos afetados

Tikiwiki

Referências · 4

• 🔥 https://exploit-db.com/exploits/4568 · Exploit
• http://info.tikiwiki.org/tiki-read_article.php?articleId=15 · Nota
• http://securityfocus.com/archive/1/482801/30/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5684 · Nota de Segurança