| ID |
CVE-2007-2024
|
| Summary |
Unrestricted file upload vulnerability in the UpLoad feature (lib/plugin/UpLoad.php) in PhpWiki 1.3.x allows remote attackers to upload arbitrary PHP files with a (1) php3, (2) php4, or (3) php5 extension. "Successful exploitation requires being logged in and that the webserver is configured to execute PHP scripts with such extensions. In the default configuration of PhpWiki, no registration or validation is necessary to log in."
|
| References |
|
| Vulnerable Configurations |
|
| CVSS |
| Base: | 6.8 (as of 16-10-2018 - 16:41) |
| Impact: | |
| Exploitability: | |
|
| CWE |
NVD-CWE-Other |
| CAPEC |
|
| Access |
| Vector | Complexity | Authentication |
| NETWORK |
MEDIUM |
NONE |
|
| Impact |
| Confidentiality | Integrity | Availability |
| PARTIAL |
PARTIAL |
PARTIAL |
|
| cvss-vector
via4
|
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
| refmap
via4
|
| bugtraq | - 20070412 Critical phpwiki c99shell exploit
- 20070412 RE: Critical phpwiki c99shell exploit
- 20070412 Re: Critical phpwiki c99shell exploit
| | cert-vn | VU#914793 | | debian | DSA-1371 | | gentoo | GLSA-200705-16 | | mlist | [phpwiki-talk] 20070413 Fwd: Critical phpwiki c99shell exploit | | secunia | | | vupen | ADV-2007-1400 |
|
| Last major update |
16-10-2018 - 16:41 |
| Published |
13-04-2007 - 18:19 |
| Last modified |
16-10-2018 - 16:41 |
