CVE-2007-5423 tiki-graph_formula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP sequences in the f array parameter, which are processed by create_function.
HighCVSS 7.5
EPSS 76.7%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
tiki-graph_formula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP sequences in the f array parameter, which are processed by create_function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tikiwiki cmsgroupware | = 1.9.8 | No fix listed |
References
- bugs.gentoo.org
- 40478 vdb-entry
- 27190 third-party-advisory
- 27344 third-party-advisory
- 3216 third-party-advisory
- securityvulns.ru exploit
- sourceforge.net
- sourceforge.net
- GLSA-200710-21 vendor-advisory
- 20071010 Vulnerabilities digest mailing-list
- 20071011 Tikiwiki 1.9.8 exploit ITW mailing-list
- 26006 exploit vdb-entry
- ADV-2007-3492 vdb-entry
- tikiwiki-tikigraphformula-command-execution(37076) vdb-entry
- 4509 exploit