PT-2007-3368 · Phpwiki · Phpwiki

Reini Urban · Published 2007-04-13 · Updated 2018-10-16 · CVE-2007-2024

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PhpWiki versions 1.3.x

Description The issue concerns an unrestricted file upload vulnerability in the UpLoad feature, specifically in the lib/plugin/UpLoad.php file. This allows remote attackers to upload arbitrary PHP files with various extensions, including php3, php4, or php5.

Recommendations For PhpWiki versions 1.3.x, restrict access to the UpLoad feature in lib/plugin/UpLoad.php to prevent arbitrary file uploads until a patch is available. Consider temporarily disabling the UpLoad feature as a mitigation measure to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-2024

DSA-1371-1

Affected Products

Phpwiki

References · 12

• http://debian.org/security/2007/dsa-1371 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200705-16.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2024 · Security Note
• http://secunia.com/advisories/24888 · Vendor Advisory
• http://kb.cert.org/vuls/id/914793 · Note
• http://securityfocus.com/archive/1/465550/100/0/threaded · Note
• http://vupen.com/english/advisories/2007/1400 · Note
• http://nabble.com/Fwd%3A-Critical-phpwiki-c99shell-exploit-t3571197.html · Note
• http://secunia.com/advisories/25307 · Note
• http://secunia.com/advisories/26784 · Note
• http://securityfocus.com/archive/1/465514/100/0/threaded · Note
• http://securityfocus.com/archive/1/465489/100/0/threaded · Note