BID:15703

MediaWiki User Language Remote Code Execution Vulnerability

Info

MediaWiki User Language Remote Code Execution Vulnerability

Bugtraq ID:	15703
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 05 2005 12:00AM
Updated:	Dec 05 2005 12:00AM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	MediaWiki MediaWiki 1.5.2 MediaWiki MediaWiki 1.5.1 MediaWiki MediaWiki 1.5 beta3 MediaWiki MediaWiki 1.5 beta2 MediaWiki MediaWiki 1.5 beta1 MediaWiki MediaWiki 1.5 alpha2 MediaWiki MediaWiki 1.5 alpha1 MediaWiki MediaWiki 1.5 .0

Not Vulnerable:	MediaWiki MediaWiki 1.5.3

Discussion

MediaWiki User Language Remote Code Execution Vulnerability

MediaWiki is prone to a remote code execution vulnerability. This is due to a lack of proper sanitization of user-supplied input.

An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the Web server process.

Successful exploitation could facilitate unauthorized access; other attacks are also possible.

Exploit / POC

MediaWiki User Language Remote Code Execution Vulnerability

An exploit is not required.

Solution / Fix

MediaWiki User Language Remote Code Execution Vulnerability

Solution:
The vendor has released version 1.5.3 to address this issue.

MediaWiki MediaWiki 1.5 beta1