BID:12110

TikiWiki Unauthorized File Upload Vulnerability

Info

TikiWiki Unauthorized File Upload Vulnerability

Bugtraq ID:	12110
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 12 2004 12:00AM
Updated:	Dec 12 2004 12:00AM
Credit:	This issue was announced by the vendor.
Vulnerable:	TikiWiki Project TikiWiki 1.9 -rc3 TikiWiki Project TikiWiki 1.9 -rc2 TikiWiki Project TikiWiki 1.9 -rc1 TikiWiki Project TikiWiki 1.8.4 + Gentoo Linux TikiWiki Project TikiWiki 1.8.3 TikiWiki Project TikiWiki 1.8.2 TikiWiki Project TikiWiki 1.8.1 TikiWiki Project TikiWiki 1.8 TikiWiki Project TikiWiki 1.7.8 TikiWiki Project TikiWiki 1.7.7 TikiWiki Project TikiWiki 1.7.6 TikiWiki Project TikiWiki 1.7.5 TikiWiki Project TikiWiki 1.7.4 TikiWiki Project TikiWiki 1.7.3 TikiWiki Project TikiWiki 1.7.2 TikiWiki Project TikiWiki 1.7.1 .1

Not Vulnerable:	TikiWiki Project TikiWiki 1.9 -rc3.1 TikiWiki Project TikiWiki 1.8.5 TikiWiki Project TikiWiki 1.7.9

Discussion

TikiWiki Unauthorized File Upload Vulnerability

TikiWiki is prone to a security vulnerability that will allow remote users to upload files with arbitrary file extensions to the computer hosting the software.

This vulnerability could allow an attacker to upload a malicious PHP script to the server and cause it to be executed. Scripts in other languages could also be executed in this manner if the Web server has a script handler configured for the file extension.

Successful exploitation will result in execution of arbitrary code in the context of the Web server.

It is reported that the attacker must have sufficient privileges to upload images to the Wiki to exploit the issue.

Exploit / POC

TikiWiki Unauthorized File Upload Vulnerability

There is no exploit required.

Solution / Fix

TikiWiki Unauthorized File Upload Vulnerability

Solution:
Gentoo has released an advisory to provide updates for this issue. Updates may be applied by running the following commands as the superuser:
emerge --sync
emerge --ask --oneshot --verbose ">=www-apps/tikiwiki-1.8.4.1"

This issue has been addressed in releases 1.7.9, 1.8.5, and 1.9-rc3.1.

TikiWiki Project TikiWiki 1.7.1 .1