telepark.wiki Multiple Security Vulnerabilities
BID:44182
Info
telepark.wiki Multiple Security Vulnerabilities
| Bugtraq ID: | 44182 |
| Class: | Input Validation Error |
| CVE: |
CVE-2009-4087 CVE-2009-4088 CVE-2009-4089 CVE-2009-4090 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 18 2009 12:00AM |
| Updated: | Nov 18 2009 12:00AM |
| Credit: | Mati Aharoni of Offensive Security |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
telepark.wiki Multiple Security Vulnerabilities
telepark.wiki is prone to multiple security vulnerabilities because it fails to properly sanitize user-supplied input. These vulnerabilities include a cross-site scripting vulnerability, multiple local file-include vulnerabilities, multiple security-bypass vulnerabilities, and an arbitrary-file-upload vulnerability.
An attacker can exploit these vulnerabilities to view and execute local files within the context of the webserver process, obtain potentially sensitive information, execute arbitrary script code in the context of the webserver process, execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, or bypass certain security restrictions to perform unauthorized actions. Other attacks are also possible.
Versions prior to telepark.wiki 2.4.25 are affected.
telepark.wiki is prone to multiple security vulnerabilities because it fails to properly sanitize user-supplied input. These vulnerabilities include a cross-site scripting vulnerability, multiple local file-include vulnerabilities, multiple security-bypass vulnerabilities, and an arbitrary-file-upload vulnerability.
An attacker can exploit these vulnerabilities to view and execute local files within the context of the webserver process, obtain potentially sensitive information, execute arbitrary script code in the context of the webserver process, execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, or bypass certain security restrictions to perform unauthorized actions. Other attacks are also possible.
Versions prior to telepark.wiki 2.4.25 are affected.
References
telepark.wiki Multiple Security Vulnerabilities
References:
References:
- telepark.wiki Product Page (telepark)
- telepark.wiki security fixes (telepark)