[38333] in bugtraq
DoKuWiki file-upload vulnerabilities
daemon@ATHENA.MIT.EDU (kreon)
Tue Apr 12 22:14:03 2005
Date: Tue, 12 Apr 2005 20:55:57 +0400
From: kreon <kre0n@mail.ru>
To: bugtraq@securityfocus.com
Message-ID: <20050412205557.7f19dae5@xaero.tvpro.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
ADZ Security Team
===================
Info
Program: DoKuWiki
Version: 2005-02-18
Module: media.php
Bug type: File Upload bug
Vendor site: http://wiki.splitbrain.org/
Vendor Informed: Yes
===================
Bug Info
Remote user with file-upload privileges can upload anyone file with any
extention/content, like a <?php system($_GET['cmd']); ?> in php-script
If uploaded file cases allowed extention, like a cmd.gif.php, system
allows to upload it
I'd tested it on php-4.3.7.
===================
Contact
ADZ Security Team
URL: http://adz.void.ru/
IRC: #adz @ QuakeNet
MAIL: kre0n@mail.ru, adz.kreon@gmail.com (for non-russian users)
