The PageListSort function in scripts/pagelist.php in PmWiki 2.x before 2.2.35 allows remote attackers to execute arbitrary code via PHP sequences in a crafted order parameter in a pagelist directive, leading to unintended use of the PHP create_function function.
References
Link | Resource |
---|---|
http://www.exploit-db.com/exploits/18243/ | Exploit |
http://www.exploit-db.com/exploits/18149/ | Exploit |
http://www.pmwiki.org/wiki/PITS/01271 | Exploit Patch |
Configurations
Configuration 1 (hide)
|
Information
Published : 2011-12-22 07:29
Updated : 2012-01-11 21:00
NVD link : CVE-2011-4453
Mitre link : CVE-2011-4453
JSON object : View
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')
Products Affected
pmwiki
- pmwiki