high7.5Public exploit code
CVE-2005-2877
The history (revision control) function in TWiki 02-Sep-2004 and earlier allows remote attackers to execute arbitrary code via shell metacharacters, as demonst…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- TWiki TWikiUsers - INCLUDE Function Arbitrary Command Execution2005-09-28 · webapps · php · Verified
- TWiki TWikiUsers - Arbitrary Command Execution2005-09-14 · webapps · php · Verified
- TWiki History TWikiUsers - 'rev' Command Execution (Metasploit)2010-07-03 · webapps · php · Verified
Impact
The history (revision control) function in TWiki 02-Sep-2004 and earlier allows remote attackers to execute arbitrary code via shell metacharacters, as demonstrated via the rev parameter to TWikiUsers.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Twiki | Twiki | Versions 2000-12-01, 2001-12-01, 2003-02-01, 2004-09-01, 2004-09-02 |
References
- NVD record
- CVE.org record
- http://marc.info/?l=bugtraq&m=112680475417550&w=2
- http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithRev
- http://www.kb.cert.org/vuls/id/757181
- http://www.securityfocus.com/bid/14834
- http://marc.info/?l=bugtraq&m=112680475417550&w=2
- http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithRev
- http://www.kb.cert.org/vuls/id/757181
- http://www.securityfocus.com/bid/14834