PT-2004-2453 · Moniwiki+1 · Moniwiki+1

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-1545

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MoniWiki versions 1.0.9.2 and earlier

Description The issue arises from the improper handling of files with multiple extensions by UploadFile.php in MoniWiki when used in conjunction with Apache mod mime. This allows remote attackers to upload files with names such as .php.hwp and execute arbitrary code.

Recommendations For MoniWiki versions 1.0.9.2 and earlier, consider restricting or disabling the UploadFile.php functionality until a proper fix is applied to handle files with multiple extensions securely. Additionally, review and enforce strict file type validation and handling to prevent the upload and execution of malicious files.

Fix

Related Identifiers

CVE-2004-1545

Affected Products

Apache Mod Mime

Moniwiki

References · 7

• http://archives.neohapsis.com/archives/fulldisclosure/2004-12/0448.html · Vendor Advisory
• http://secunia.com/advisories/13478 · Vendor Advisory
• http://securityfocus.com/bid/11951 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2004-1545 · Security Note
• http://marc.info/?l=bugtraq&m=110314544711884&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18493 · Note
• http://kldp.net/scm/cvsweb.php/moniwiki/plugin/UploadFile.php.diff?cvsroot=moniwiki&only_with_tag=HEAD&r1=text&tr1=1.17&r2=text&tr2=1.16&f=h · Note