Description

Unauthenticated users can upload and execute arbitrary code due to a vulnerability in a preinstalled third-party component ("ELFinder"). An unauthenticated user can upload and PHP file with arbitrary code and execute it with the permissions of the web server user.

Remediation

Upgrade Tiki Wiki CMS to version 12.9, 14.4, 15.2 or above (recommended)

References

Tiki Wiki Announcement (2016-07-08)

Related Vulnerabilities

PHP opcache-gui publicly accessible

Version Disclosure (ASP.NET)

WordPress Plugin Backup Migration Information Disclosure (1.2.8)

GraphQL Field Suggestions Enabled

WordPress Plugin Simple Download Button Shortcode 'file' Parameter Information Disclosure (1.0)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Information Disclosure Code Execution