high7.8Public exploit code
CVE-2008-5322
Wysi Wiki Wyg 1.0 allows remote attackers to obtain system information via an invalid categup parameter to index.php, which calls the phpinfo function.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Wysi Wiki Wyg 1.0 - Local File Inclusion / Cross-Site Scripting / PHPInfo2008-10-20 · webapps · php · Verified
Impact
Wysi Wiki Wyg 1.0 allows remote attackers to obtain system information via an invalid categup parameter to index.php, which calls the phpinfo function.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Easy-Script | Wysi Wiki Wyg | Version 1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.org/0810-exploits/wysiwikiwyg-lfixssdisclose.txt
- http://secunia.com/advisories/31061
- https://exchange.xforce.ibmcloud.com/vulnerabilities/47105
- https://www.exploit-db.com/exploits/6042
- http://packetstormsecurity.org/0810-exploits/wysiwikiwyg-lfixssdisclose.txt
- http://secunia.com/advisories/31061
- https://exchange.xforce.ibmcloud.com/vulnerabilities/47105
- https://www.exploit-db.com/exploits/6042