PT-2007-6675 · Tikiwiki · Tikiwiki

Published 2007-10-26 · Updated 2012-10-24 · CVE-2007-5684

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TikiWiki versions 1.9.8.1 and earlier

Description The issue allows remote attackers to include and execute arbitrary files. This can be achieved via absolute pathnames in the error handler file and local php parameters to "tiki-index.php", or through encoded "..%2F" sequences in the imp language parameter to "tiki-imexport languages.php".

Recommendations For TikiWiki versions 1.9.8.1 and earlier, consider disabling access to the tiki-index.php and tiki-imexport languages.php scripts until a fix is available. Restrict the use of the error handler file and local php parameters in "tiki-index.php" and the imp language parameter in "tiki-imexport languages.php" to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2007-5684

Affected Products

Tikiwiki

References · 4

• 🔥 https://exploit-db.com/exploits/4568 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-5684 · Security Note
• http://info.tikiwiki.org/tiki-read_article.php?articleId=15 · Note
• http://securityfocus.com/archive/1/482801/30/0/threaded · Note