DokuWiki Remote PHP Script Code Injection Vulnerability

Bugtraq ID:	18289
Class:	Input Validation Error
CVE:	CVE-2006-2878
Remote:	Yes
Local:	No
Published:	Jun 05 2006 12:00AM
Updated:	Jun 14 2006 11:01PM
Credit:	Stefan Esser is credited with the discovery of this vulnerability.
Vulnerable:	Gentoo Linux DokuWiki DokuWiki 2006.6.4 DokuWiki DokuWiki 2006.3.5 DokuWiki DokuWiki 2005.9.22 DokuWiki DokuWiki 2004-10-19 DokuWiki DokuWiki 2004-09-30 DokuWiki DokuWiki 2004-09-25 DokuWiki DokuWiki 2004-09-12 DokuWiki DokuWiki 2004-08-22 DokuWiki DokuWiki 2004-08-15a DokuWiki DokuWiki 2004-08-15 DokuWiki DokuWiki 2004-08-08 DokuWiki DokuWiki 2004-07-25 DokuWiki DokuWiki 2004-07-21
Not Vulnerable:	DokuWiki DokuWiki 2006.3.9

DokuWiki Remote PHP Script Code Injection Vulnerability

DokuWiki is prone to a remote PHP code-injection vulnerability.

An attacker can exploit this issue to facilitate a compromise of the application and the underlying system; other attacks are also possible.

DokuWiki versions 2006-06-04 and prior are vulnerable; other versions may also be affected.

DokuWiki Remote PHP Script Code Injection Vulnerability

This issue can be exploited through a web client.

DokuWiki Remote PHP Script Code Injection Vulnerability

Solution:
The vendor has released version 2006-03-09 of DocuWiki to address this issue.

Please see the referenced advisories for further information.

DokuWiki Remote PHP Script Code Injection Vulnerability

References:

• DokuWiki Web Site (DokuWiki)
  
• Advisory 04/2006: DokuWiki PHP code execution vulnerability in spellchecker (Stefan Esser )