Description
TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieName to lib/banners/bannerlib.php; (2) printpages or (3) printstructures parameter to (a) tiki-print_multi_pages.php or (b) tiki-print_pages.php; or (4) sendpages, (5) sendstructures, or (6) sendarticles parameter to tiki-send_objects.php, which is not properly handled when processed by the unserialize function.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.exploit-db.com/exploits/19630 ↗
- http://www.exploit-db.com/exploits/19573 ↗
- http://info.tiki.org/article190-Tiki-Wiki-CMS-Groupware-Updates-Tiki-6-7-LTS ↗
- http://www.securityfocus.com/bid/54298 ↗
- http://dev.tiki.org/item4109 ↗
- http://osvdb.org/83534 ↗
- http://archives.neohapsis.com/archives/bugtraq/2012-07/0020.html ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/76758 ↗
- http://info.tiki.org/article191-Tiki-Releases-8-4 ↗