Lucene search

CVE-2012-0911

🗓️ 12 Jul 2012 19:03:55Reported by mitreType

cve🔗 web.nvd.nist.gov👁 124 Views🌐 WEB

TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object

AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

Reporter	Title	Published	Views	Family All 18
0day.today	Tiki Wiki CMS Groupware <= 8.3 "unserialize()" PHP Code Execution	4 Jul 201200:00	–	zdt
0day.today	Tiki Wiki <= 8.3 unserialize() PHP Code Execution	9 Jul 201200:00	–	zdt
Metasploit	Tiki Wiki unserialize() PHP Code Execution	5 Jul 201218:58	–	metasploit
NVD	CVE-2012-0911	12 Jul 201219:55	–	nvd
Packet Storm	Tiki Wiki <= 8.3 unserialize() PHP Code Execution	6 Jul 201200:00	–	packetstorm
Packet Storm	Tiki Wiki CMS Groupware 8.3 Code Execution	4 Jul 201200:00	–	packetstorm
seebug.org	Tiki Wiki CMS Groupware 'unserialize()' PHP代码执行漏洞	6 Jul 201200:00	–	seebug
seebug.org	Tiki Wiki CMS Groupware <= 8.3 "unserialize()" PHP Code Execution	1 Jul 201400:00	–	seebug
Exploit DB	Tiki Wiki CMS Groupware 8.3 - 'Unserialize()' PHP Code Execution	4 Jul 201200:00	–	exploitdb
Exploit DB	Tiki Wiki CMS Groupware 8.3 - 'Unserialize()' PHP Code Execution (Metasploit)	9 Jul 201200:00	–	exploitdb

Nvd

Node

tiki tikiwiki_cms/groupwareRange<6.7lts

tiki tikiwiki_cms/groupwareRange<8.4-

Source	Link
securityfocus	www.securityfocus.com/bid/54298
info	www.info.tiki.org/article191-Tiki-Releases-8-4
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/76758
exploit-db	www.exploit-db.com/exploits/19630
exploit-db	www.exploit-db.com/exploits/19573
osvdb	www.osvdb.org/83534
dev	www.dev.tiki.org/item4109
info	www.info.tiki.org/article190-Tiki-Wiki-CMS-Groupware-Updates-Tiki-6-7-LTS
archives	www.archives.neohapsis.com/archives/bugtraq/2012-07/0020.html

Parameter	Position	Path	Description	CWE
printpages	request body	tiki-print_multi_pages.php	This endpoint allows arbitrary PHP code execution via user-controlled input passed to unserialize function.	CWE-502
printpages	request body	tiki-print_pages.php	This endpoint allows arbitrary PHP code execution via user-controlled input passed to unserialize function.	CWE-502
printstructures	request body	tiki-print_pages.php	This endpoint allows arbitrary PHP code execution via user-controlled input passed to unserialize function.	CWE-502
sendpages	request body	tiki-send_objects.php	This endpoint allows arbitrary PHP code execution via user-controlled input passed to unserialize function.	CWE-502
sendstructures	request body	tiki-send_objects.php	This endpoint allows arbitrary PHP code execution via user-controlled input passed to unserialize function.	CWE-502
sendarticles	request body	tiki-send_objects.php	This endpoint allows arbitrary PHP code execution via user-controlled input passed to unserialize function.	CWE-502
cookieName	request body	lib/banners/bannerlib.php	This endpoint allows arbitrary PHP code execution via user-controlled input passed to unserialize function.	CWE-502

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

12 Jul 2012 19:55Current

9.5High risk

Vulners AI Score9.5

CVSS27.5

CVSS39.8

EPSS0.77945

CWE-502