CVE-2012-0911 TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieName to lib/banners/bannerlib.php; (2) print...
CriticalCVSS 9.8
EPSS 63.0%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieName to lib/banners/bannerlib.php; (2) printpages or (3) printstructures parameter to (a) tiki-print_multi_pages.php or (b) tiki-print_pages.php; or (4) sendpages, (5) sendstructures, or (6) sendarticles parameter to tiki-send_objects.php, which is not properly handled when processed by the unserialize function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tikiwiki cmsgroupware | < 6.7 | 6.7 |
| tikiwiki cmsgroupware | < 8.4 | 8.4 |
References
- 20120704 [CVE-2012-0911] Tiki Wiki CMS Groupware <= 8.3 "unserialize()" PHP Code Execution exploit mailing-list
- dev.tiki.org broken-link
- info.tiki.org vendor-advisory
- info.tiki.org release-notes
- 83534 broken-link vdb-entry
- 19573 exploit third-party-advisory vdb-entry
- 19630 exploit third-party-advisory vdb-entry
- 54298 broken-link vdb-entry
- tikiwiki-unserialize-code-exec(76758) third-party-advisory vdb-entry