vendor:
DokuWiki
by:
rgod
7.5
CVSS
HIGH
Remote Code Execution
78
CWE
Product Name: DokuWiki
Affected Version From: DokuWiki <= 2006-03-09b
Affected Version To: DokuWiki <= 2006-03-09b
Patch Exists: NO
Related CWE: CVE-2006-1053
CPE: a:dokuwiki:dokuwiki:2006-03-09b
Platforms Tested:
2006
DokuWiki Remote Commands Execution
This exploit allows remote attackers to execute arbitrary commands on a server running DokuWiki <= 2006-03-09b release by exploiting a vulnerability in the /bin/dwpage.php script. The vulnerability can be triggered if the register_argc_argv setting is turned on. By sending a specially crafted request, an attacker can inject shell commands and execute them on the target server.
Mitigation:
To mitigate this vulnerability, users should update to a newer version of DokuWiki that includes a patch for this issue. It is also recommended to disable the register_argc_argv setting if it is not required.