WikkiTikkiTavi Remote File Include Vulnerability
BID:3946
Info
WikkiTikkiTavi Remote File Include Vulnerability
| Bugtraq ID: | 3946 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 02 2002 12:00AM |
| Updated: | Jan 02 2002 12:00AM |
| Credit: | This issue was originally publicized via the Tavi-devel mailing list by the author Scott Moonen on January 2nd, 2002 |
| Vulnerable: |
WikkiTikkiTavi WikkiTikkiTavi 0.20 WikkiTikkiTavi WikkiTikkiTavi 0.10 WikkiTikkiTavi WikkiTikkiTavi 0.5 |
| Not Vulnerable: |
WikkiTikkiTavi WikkiTikkiTavi 0.21 0.21 |
Discussion
WikkiTikkiTavi Remote File Include Vulnerability
WikkiTikkiTavi is a freely available engine for running a Wiki site. Wiki sites are web communities which are based on the idea that every webpage is editable by users of the website. WikkiTikkiTavi is back-ended by a MySQL database and runs on most Linux and Unix variants, as well as Microsoft Windows NT/2000 operating systems.
WikkiTikkiTavi permits remote file including. As a result, a remote attacker may include an arbitrary file located on a remote host. This may be exploited via a malicious web request. If this file is a PHP script, it will be executed on the host running the vulnerable software with the privileges of the webserver.
The attacker may use this as an opportunity to gain local access on the host running the vulnerable software.
WikkiTikkiTavi is a freely available engine for running a Wiki site. Wiki sites are web communities which are based on the idea that every webpage is editable by users of the website. WikkiTikkiTavi is back-ended by a MySQL database and runs on most Linux and Unix variants, as well as Microsoft Windows NT/2000 operating systems.
WikkiTikkiTavi permits remote file including. As a result, a remote attacker may include an arbitrary file located on a remote host. This may be exploited via a malicious web request. If this file is a PHP script, it will be executed on the host running the vulnerable software with the privileges of the webserver.
The attacker may use this as an opportunity to gain local access on the host running the vulnerable software.