BID:11486

DokuWiki Remote Arbitrary File Upload Vulnerability

Info

DokuWiki Remote Arbitrary File Upload Vulnerability

Bugtraq ID:	11486
Class:	Input Validation Error
CVE:	CVE-2004-2560
Remote:	Yes
Local:	No
Published:	Oct 20 2004 12:00AM
Updated:	Jul 12 2009 08:06AM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	DokuWiki DokuWiki 2004-09-30 DokuWiki DokuWiki 2004-09-25 DokuWiki DokuWiki 2004-09-12 DokuWiki DokuWiki 2004-08-22 DokuWiki DokuWiki 2004-08-15a DokuWiki DokuWiki 2004-08-15 DokuWiki DokuWiki 2004-08-08 DokuWiki DokuWiki 2004-07-25 DokuWiki DokuWiki 2004-07-21

Not Vulnerable:	DokuWiki DokuWiki 2004-10-19

Discussion

DokuWiki Remote Arbitrary File Upload Vulnerability

DokuWiki is reported prone to a remote arbitrary file upload vulnerability. This issue can allow attackers to upload arbitrary files such as PHP scripts to a vulnerable computer. These files could be executed by the hosting Web server, resulting in arbitrary code execution.

This vulnerability has been reported for DokuWiki 2004-09-30 and prior.

Exploit / POC

DokuWiki Remote Arbitrary File Upload Vulnerability

An exploit is likely not required to trigger this issue.

Solution / Fix

DokuWiki Remote Arbitrary File Upload Vulnerability

Solution:
DokuWiki 2004-10-19 is available to address this issue.

DokuWiki DokuWiki 2004-09-25