critical9.3Public exploit code
CVE-2009-1960
inc/init.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when register_globals is enabled, allows remote attackers to include and execute arbitrary…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Dokuwiki 2009-02-14 - Temporary/Remote File Inclusion2009-05-26 · webapps · php · Verified
- Dokuwiki 2009-02-14 - Local File Inclusion2009-05-26 · webapps · php · Verified
Impact
inc/init.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via the config_cascade[main][default][] parameter to doku.php. NOTE: PHP remote file inclusion is also possible in PHP 5 using ftp:// URLs.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dokuwiki | Dokuwiki | Versions 2009-02-14, rc2009-01-30, rc2009-02-06 |
Weakness classification
References
- NVD record
- CVE.org record
- http://bugs.splitbrain.org/index.php?do=details&task_id=1700
- http://dev.splitbrain.org/darcsweb/darcsweb.cgi?r=dokuwiki%3Ba=commitdiff%3Bh=20090526145030-7ad00-c0483e021f47898c8597f3bfbdd26c637f891d86.gz
- http://secunia.com/advisories/35218
- http://www.securityfocus.com/bid/35095
- https://www.exploit-db.com/exploits/8781
- https://www.exploit-db.com/exploits/8812
- http://bugs.splitbrain.org/index.php?do=details&task_id=1700
- http://dev.splitbrain.org/darcsweb/darcsweb.cgi?r=dokuwiki%3Ba=commitdiff%3Bh=20090526145030-7ad00-c0483e021f47898c8597f3bfbdd26c637f891d86.gz
- http://secunia.com/advisories/35218
- http://www.securityfocus.com/bid/35095
- https://www.exploit-db.com/exploits/8781
- https://www.exploit-db.com/exploits/8812