CVE-2006-4602

Published: 07/09/2006 Updated: 19/10/2017

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 760

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Unrestricted file upload vulnerability in jhot.php in TikiWiki 1.9.4 Sirius and previous versions allows remote malicious users to execute arbitrary PHP code via a filepath parameter that contains a filename with a .php extension, which is uploaded to the img/wiki/ directory.

Vulnerable Product	Search on Vulmon	Subscribe to Product
tiki tikiwiki cms\\/groupware 1.9.4

#!/usr/bin/php -q -d short_open_tag=on <? print_r(' -------------------------------------------------------------------------------- TikiWiki <= 19 Sirius "jhotphp" remote commands execution exploit by rgod rgod@autisticiorg site: retrogodaltervistaorg dork: "powered by tikiwiki" --------------------------------------------------- ...

## # $Id: tikiwiki_jhot_execrb 9929 2010-07-25 21:37:54Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # Framework web site for more information on licensing and terms of use # metasploitcom/framework/ ## require 'msf/core' cla ...

NVD-CWE-Other http://isc.sans.org/diary.php?storyid=1672 http://tikiwiki.org/tiki-read_article.php?articleId=136 http://www.securityfocus.com/bid/19819 http://secunia.com/advisories/21733 http://www.osvdb.org/28456 http://security.gentoo.org/glsa/glsa-200609-16.xml http://secunia.com/advisories/22100 http://www.vupen.com/english/advisories/2006/3450 https://www.exploit-db.com/exploits/2288 https://nvd.nist.gov https://www.exploit-db.com/exploits/2288/

CVE-2006-4602

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect