Tiki Wiki CMS Groupware 'unserialize()' Multiple Remote PHP Code Execution Vulnerabilities

Bugtraq ID:	57034
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 24 2012 12:00AM
Updated:	Jan 03 2013 09:30PM
Credit:	Egidio Romano
Vulnerable:	Tiki Wiki CMS Groupware Tiki Wiki CMS Groupware 8.2 Tiki Wiki CMS Groupware Tiki Wiki CMS Groupware 6.5 LTS Tiki Wiki CMS Groupware Tiki Wiki CMS Groupware 6.4 LTS
Not Vulnerable:

Tiki Wiki CMS Groupware 'unserialize()' Multiple Remote PHP Code Execution Vulnerabilities

Tiki Wiki CMS Groupware is prone to multiple remote PHP code-execution vulnerabilities.

An attacker can exploit these issues to inject and execute arbitrary malicious PHP code in the context of the affected application. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

Versions prior to Tiki Wiki CMS Groupware 6.9 and 9.3 are vulnerable.

Tiki Wiki CMS Groupware 'unserialize()' Multiple Remote PHP Code Execution Vulnerabilities

Attackers can exploit these issues using a browser.

Tiki Wiki CMS Groupware 'unserialize()' Multiple Remote PHP Code Execution Vulnerabilities

Solution:
Updates are available. Please see the references for details.

Tiki Wiki CMS Groupware 'unserialize()' Multiple Remote PHP Code Execution Vulnerabilities

References:

• Tiki Wiki CMS Groupware Homepage (Tiki Wiki CMS Groupware)