TikiWiki Tiki-Graph_Formula.PHP Code Injection Vulnerability

Bugtraq ID:	26006
Class:	Input Validation Error
CVE:	CVE-2007-5423
Remote:	Yes
Local:	No
Published:	Oct 10 2007 12:00AM
Updated:	Oct 24 2007 03:07PM
Credit:	ShAnKaR is credited with the discovery of this vulnerability.
Vulnerable:	TikiWiki Project TikiWiki 1.9.8 Gentoo Linux
Not Vulnerable:

TikiWiki Tiki-Graph_Formula.PHP Code Injection Vulnerability

TikiWiki is prone to a remote PHP code-injection vulnerability.

An attacker can exploit this issue to inject and execute arbitrary malicious PHP code in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

TikiWiki 1.9.8 is vulnerable; other versions may also be affected.

TikiWiki Tiki-Graph_Formula.PHP Code Injection Vulnerability

Attackers can exploit this issue via a browser.

The following exploit code is available:

• /data/vulnerabilities/exploits/26006.html
• /data/vulnerabilities/exploits/26006.pl

TikiWiki Tiki-Graph_Formula.PHP Code Injection Vulnerability

Solution:
Updates are available to address this issue. Please see the references for more information.

TikiWiki Tiki-Graph_Formula.PHP Code Injection Vulnerability

References:

• TikiWiki Homepage (TikiWiki)
  
• Item #12, Vulnerabilities digest (3APA3A)
  
• Tikiwiki 1.9.8 exploit ITW (Moritz Naumann )