PT-2012-2055 · Hdwiki · Hdwiki

Publicado 2012-02-08 · Atualizado 2012-02-08 · CVE-2011-5077

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions HDWiki version 5.0

Description The issue concerns an unrestricted file upload vulnerability in the attachment.php file. This allows remote attackers to execute arbitrary code by uploading a file with an executable extension and then accessing it via a direct request to the file in the image directory.

Recommendations For HDWiki version 5.0, consider restricting file uploads to only allow non-executable file extensions as a temporary workaround until a patch is available. Restrict access to the attachment.php file to minimize the risk of exploitation. Avoid using the attachment.php file for uploading files until the issue is resolved.

Correção

Identificadores relacionados

CVE-2011-5077

Produtos afetados

Hdwiki

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2011-5077 · Nota de Segurança
• http://bbs.wolvez.org/viewtopic.php?id=208 · Nota