header-logo
Suggest Exploit
vendor:
DokuWiki
by:
rgod
7.5
CVSS
HIGH
Remote Code Execution
78
CWE
Product Name: DokuWiki
Affected Version From: DokuWiki <= 2006-03-09b
Affected Version To: DokuWiki <= 2006-03-09b
Patch Exists: NO
Related CWE: CVE-2006-1053
CPE: a:dokuwiki:dokuwiki:2006-03-09b
Metasploit:
Other Scripts:
Platforms Tested:
2006

DokuWiki Remote Commands Execution

This exploit allows remote attackers to execute arbitrary commands on a server running DokuWiki <= 2006-03-09b release by exploiting a vulnerability in the /bin/dwpage.php script. The vulnerability can be triggered if the register_argc_argv setting is turned on. By sending a specially crafted request, an attacker can inject shell commands and execute them on the target server.

Mitigation:

To mitigate this vulnerability, users should update to a newer version of DokuWiki that includes a patch for this issue. It is also recommended to disable the register_argc_argv setting if it is not required.
Source

Exploit-DB raw data: