Full Disclosure mailing list archives
Tikiwiki 1.9.8 exploit ITW
From: Moritz Naumann <security () moritz-naumann com>
Date: Thu, 11 Oct 2007 23:20:06 +0200
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, there's a tikiwiki (tikiwiki.org) remote code execution exploit in the wild, targetting v.1.9.8 and earlier. This vulnerability is being exploited by multiple hosts (likely a botnet) using multiple payload websites since at least Tue 08:00 PM UTC to gain access to several users' hotmail accounts. Disabling url_fopen() or denying access to tiki-graph_formula.php for unauthenticated users will prevent your site from being exploited. I've notified the developers. If, what it says on http://dev.tikiwiki.org/Security is up to date (i.e. unfixed security issues of high priority initially reported 9 months ago), then you really should not use this software. Moritz -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFHDpOGn6GkvSd/BgwRCsWxAJ9bTbidmQne58/L+KmMKRM9+qK5PgCgl+Q7 e5sorw+ecp/4TO4YydX5FxA= =0mUm -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Tikiwiki 1.9.8 exploit ITW Moritz Naumann (Oct 11)
- Re: Tikiwiki 1.9.8 exploit ITW 3APA3A (Oct 12)
- <Possible follow-ups>
- Re: Tikiwiki 1.9.8 exploit ITW full-disclosure (Oct 12)