CVE-2004-1037

The search function in TWiki 20030201 allows remote attackers to execute arbitrary commands via shell metacharacters in a search string...

[SA14384] TWiki ImageGalleryPlugin Shell Command Injection

TITLE: TWiki ImageGalleryPlugin Shell Command Injection SECUNIA ADVISORY ID: SA14384 VERIFY ADVISORY: http://secunia.com/advisories/14384/ CRITICAL: Moderately critical IMPACT: System access WHERE: From remote SOFTWARE: ImageGalleryPlugin 1.x TWiki plugin http://secunia.com/product/4707/...

TWiki ImageGalleryPlugin Shell Command Injection

According to its version number, the instance of TWiki running on the remote host is affected by a shell command injection vulnerability in the ImageGalleryPlugin component. In addition, the wording of a 'robustness' patch released by the vendor indicates this version may be affected by other inp...

CVE-2005-0516

The ImageGalleryPlugin ImageGalleryPlugin.pm in Twiki allows remote attackers to execute arbitrary commands via certain commands that generate thumbnails...

CVE-2005-0516

The ImageGalleryPlugin ImageGalleryPlugin.pm in Twiki allows remote attackers to execute arbitrary commands via certain commands that generate thumbnails...

CVE-2005-0516

CVE-2005-0516 affects the Twiki ImageGalleryPlugin (ImageGalleryPlugin.pm). The vulnerability is a remote command-injection flaw exposed via certain thumbnail-generation commands, potentially allowing an attacker to execute arbitrary commands on the server. Connected sources corroborate a shell-c...

[Full-Disclosure] [ GLSA 200411-33 ] TWiki: Arbitrary command execution

Gentoo Linux Security Advisory GLSA 200411-33 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

TWiki: Arbitrary command execution

Background TWiki is a Web-based groupware tool based around the concept of wiki pages that can be edited by anybody with a Web browser. Description The TWiki search function, which uses a shell command executed via the Perl backtick operator, does not properly escape shell metacharacters in the...

GLSA-200411-33 : TWiki: Arbitrary command execution

The remote host is affected by the vulnerability described in GLSA-200411-33 TWiki: Arbitrary command execution The TWiki search function, which uses a shell command executed via the Perl backtick operator, does not properly escape shell metacharacters in the user-provided search string. Impact :...

FreeBSD : twiki -- arbitrary shell command execution (196)

The following package needs to be updated: twiki %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkgb4af3ede36e911d9a9e70001020eed82.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyright 2003-20...

TWiki 20030201 - search.pm Remote Command Execution

TWiki 20030201 - search.pm Remote Command Execution !/usr/bin/perl "tweaky.pl" v. 1.0 beta 2 Proof of concept for TWiki vulnerability. Remote code execution Vuln discovered, researched and exploited by RoMaNSoFt Madrid, 30.Sep.2004. require LWP::UserAgent; use Getopt::Long; Default config $host =...

TWiki 20030201 search.pm Remote Command Execution Exploit

Exploit for cgi platform in category web applications ========================================================= TWiki 20030201 search.pm Remote Command Execution Exploit ========================================================= !/usr/bin/perl "tweaky.pl" v. 1.0 beta 2 Proof of concept for TWiki...

TWiki 20030201 search.pm Remote Command Execution Exploit

No description provided by source. !/usr/bin/perl "tweaky.pl" v. 1.0 beta 2 Proof of concept for TWiki vulnerability. Remote code execution Vuln discovered, researched and exploited by RoMaNSoFt roman rs-labs com Madrid, 30.Sep.2004. require LWP::UserAgent; use Getopt::Long; Default config $host ...

TWiki 20030201 - 'search.pm' Remote Command Execution

!/usr/bin/perl "tweaky.pl" v. 1.0 beta 2 Proof of concept for TWiki vulnerability. Remote code execution Vuln discovered, researched and exploited by RoMaNSoFt Madrid, 30.Sep.2004. require LWP::UserAgent; use Getopt::Long; Default config $host = ''; $path = '/cgi-bin/twiki/search/Main/'; $secure ...

CVE-2004-1037

CVE-2004-1037 affects TWiki prior to fix where the search function accepts a user-supplied search string. The vulnerability allows remote attackers to execute arbitrary OS commands by injecting shell metacharacters in the search parameter to the WebSearch script, potentially compromising the TWik...

CVE-2004-1037

The search function in TWiki 20030201 allows remote attackers to execute arbitrary commands via shell metacharacters in a search string...

[Full-Disclosure] TWiki search function allows arbitrary shell command execution

VULNERABLE SOFTWARE VERSIONS TWiki http://twiki.org/ - TWiki 20030201 e.g. Debian Sarge - probably later versions - Subversion repository at http://ntwiki.ethermage.net:8181/svn/twiki/trunk at least until revision 3224 including ATTACK VECTORS HTTP GET requests towards the Wiki server typically...

twiki -- arbitrary shell command execution

Hans Ulrich Niedermann reports: The TWiki search function uses a user supplied search string to compose a command line executed by the Perl backtick operator. The search string is not checked properly for shell metacharacters and is thus vulnerable to search string containing quotes and shell...

TWiki Search Function Arbitrary Command Execution

This module exploits a vulnerability in the search component of TWiki. By passing a 'search' parameter containing shell metacharacters to a 'Search' script, an attacker can execute arbitrary OS commands. Affected versions: - 20040901 - 20030201 - 20011201 - 20001201 - SVN up to and including...