Description

Multiple directory traversal vulnerabilities in (1) languages/Language.php and (2) includes/StubObject.php in MediaWiki 1.8.0 and other versions before 1.16.2, when running on Windows and possibly Novell Netware, allow remote attackers to include and execute arbitrary local PHP files via vectors related to a crafted language file and the Language::factory function.

Remediation

References

CVE-2011-0537

Related Vulnerabilities

WordPress Plugin Product Catalog Multiple SQL Injection Vulnerabilities (2.1)

PostgreSQL Numeric Errors Vulnerability (CVE-2014-2669)

WordPress Plugin WP RSS By Publishers Multiple SQL Injection Vulnerabilities (0.1)

osTicket Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-22608)

qdPM Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2023-45855)

Severity

High

Classification

CVE-2011-0537 CWE-22

Tags

Missing Update Known Vulnerabilities