Multiple directory traversal vulnerabilities in ErfurtWiki R1.02b and earlier, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) ewiki_id and (2) ewiki_action parameters to fragments/css.php, and possibly the (3) id parameter to the default URI. NOTE: the default URI is site-specific but often performs an include_once of ewiki.php.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2008-06-12T01:30:00
Updated: 2024-08-07T09:14:13.468Z
Reserved: 2008-06-11T00:00:00
Link: CVE-2008-2672
Vulnrichment
No data.
NVD
Status : Modified
Published: 2008-06-12T02:32:00.000
Modified: 2018-10-11T20:42:25.100
Link: CVE-2008-2672
Redhat
No data.