PmWiki Multiple Input Validation Vulnerabilities
PmWiki is prone to multiple input-validation vulnerabilities. These issues are due to failures in the application to properly sanitize user-supplied input. Exploitation of the Arbitrary Remote File-Include vulnerability will result in the execution of attacker-supplied code in the context of the webserver process. This may facilitate a compromise of the application and the underlying system. Exploitation of the Unspecified HTML-Injection issue will permit an attacker to inject arbitrary HTML code. When viewed, this code will be executed in the browser of a victim user in the context of the webserver process. Successful exploitation may aid in the theft of cookie-based authentication credentials, or allow the attacker to control how the site is rendered to the user; other attacks are also possible.
