PT-2020-16656 · Lionwiki · Lionwiki

Published 2020-11-16 · Updated 2020-11-30 · CVE-2020-27191

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LionWiki versions prior to 3.2.12

Description The issue allows an unauthenticated user to read files as the web server user via a crafted string in the f1 variable in index.php, also known as Local File Inclusion. This affects products that are no longer supported by the maintainer.

Recommendations For versions prior to 3.2.12, update to version 3.2.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the index.php file or disabling the f1 variable to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2020-27191

Affected Products

Lionwiki

References · 6

• 🔥 https://junebug.site/blog/cve-2020-27191-lionwiki-3-2-11-lfi · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-27191 · Security Note
• https://osv.dev/vulnerability/CVE-2020-27191 · Vendor Advisory
• http://lionwiki.0o.cz/index.php?page=Main+page · Vendor Advisory
• https://t.me/cvenotify/5617 · Telegram Post
• https://t.me/cibsecurity/16366 · Telegram Post