Tiki Wiki CMS Groupware 'unserialize()' PHP Code Execution Vulnerability

Bugtraq ID:	56282
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 26 2012 12:00AM
Updated:	Oct 26 2012 12:00AM
Credit:	Egidio Romano
Vulnerable:	Tiki Wiki CMS Groupware Tiki Wiki CMS Groupware 8.2 Tiki Wiki CMS Groupware Tiki Wiki CMS Groupware 7.0 Tiki Wiki CMS Groupware Tiki Wiki CMS Groupware 6.5 LTS Tiki Wiki CMS Groupware Tiki Wiki CMS Groupware 6.4 LTS Tiki Wiki CMS Groupware Tiki Wiki CMS Groupware 5.2
Not Vulnerable:

Tiki Wiki CMS Groupware 'unserialize()' PHP Code Execution Vulnerability

Tiki Wiki CMS Groupware is prone to a remote PHP code-execution vulnerability.

An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the affected application. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

Tiki Wiki CMS Groupware versions prior to 6.8 and 9.2 are vulnerable.

Tiki Wiki CMS Groupware 'unserialize()' PHP Code Execution Vulnerability

Attackers can exploit this issue using a browser.

Tiki Wiki CMS Groupware 'unserialize()' PHP Code Execution Vulnerability

Solution:
Updates are available. Please see the references for details.

Tiki Wiki CMS Groupware 'unserialize()' PHP Code Execution Vulnerability

References:

• Tiki Wiki CMS Groupware Homepage (Tiki Wiki CMS Groupware)