#VU1364 Unrestricted file upload in PhpWiki - CVE-2007-2025
Published: December 16, 2016
Vulnerability identifier: #VU1364
Vulnerability risk: Critical
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red
CVE-ID: CVE-2007-2025
CWE-ID: CWE-434
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
PhpWiki
PhpWiki
Software vendor:
Marc-Etienne Vargenau
Marc-Etienne Vargenau
Description
The vulnerability allows a remote attacker to execute arbitrary OS commands on vulnerable system.
The vulnerability exists due to insufficient sanitization of filename extension in lib/plugin/UpLoad.php when uploading files via UpLoad feature. A remote attacker can use php3 extension to bypass implemented protection mechanism, upload and execute malicious PHP file on vulnerable system.
Successful exploitation of the vulnerability may allow an attacker to execute arbitrary OS commands vulnerable system with privileges of the web server account.
Note: this vulnerability is being actively exploited.
Remediation
Install update from vendor's website.