PhpWiki: Remote execution of arbitrary code — GLSA 200705-16

A vulnerability has been discovered in PhpWiki allowing for the remote execution of arbitrary code.

Affected Packages

www-apps/phpwiki on all architectures
Affected versions < 1.3.10-r3
Unaffected versions >= 1.3.10-r3

Background

PhpWiki is an open source content management system written in PHP.

Description

Harold Hallikainen has reported that the Upload page fails to properly check the extension of a file.

Impact

A remote attacker could upload a specially crafted PHP file to the vulnerable server, resulting in the execution of arbitrary PHP code with the privileges of the user running PhpWiki.

Workaround

There is no known workaround at this time.

Resolution

All PhpWiki users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=www-apps/phpwiki-1.3.10-r3"

References

Release Date
May 17, 2007

Latest Revision
May 17, 2007: 01

Severity
high

Exploitable
remote

Bugzilla entries