Tiki Wiki CMS Groupware 'unserialize()' Multiple PHP Code Execution Vulnerabilities

Bugtraq ID:	54298
Class:	Input Validation Error
CVE:	CVE-2012-0911
Remote:	Yes
Local:	No
Published:	Jul 04 2012 12:00AM
Updated:	Jul 09 2012 11:00AM
Credit:	Egidio Romano
Vulnerable:
Not Vulnerable:

Tiki Wiki CMS Groupware 'unserialize()' Multiple PHP Code Execution Vulnerabilities

Tiki Wiki CMS Groupware is prone to multiple remote PHP code-execution vulnerabilities.

An attacker can exploit these issues to inject and execute arbitrary malicious PHP code in the context of the affected application. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

Tiki Wiki CMS Groupware 8.3 is vulnerable; other versions may also be affected.

Tiki Wiki CMS Groupware 'unserialize()' Multiple PHP Code Execution Vulnerabilities

Attackers can exploit these issues using a browser.

The following exploits are available:

• /data/vulnerabilities/exploits/54298.rb
• /data/vulnerabilities/exploits/54298.txt

Tiki Wiki CMS Groupware 'unserialize()' Multiple PHP Code Execution Vulnerabilities

Solution:
Updates are available. Please see the references for details.

Tiki Wiki CMS Groupware 'unserialize()' Multiple PHP Code Execution Vulnerabilities

References:

• Tiki Wiki CMS Groupware Homepage (Tiki Wiki CMS Groupware)