The PageListSort function in scripts/pagelist.php in PmWiki 2.x before 2.2.35 allows remote attackers to execute arbitrary code via PHP sequences in a crafted order parameter in a pagelist directive, leading to unintended use of the PHP create_function function.
References
Link | Resource |
---|---|
http://www.exploit-db.com/exploits/18149/ | Exploit |
http://www.exploit-db.com/exploits/18243/ | Exploit |
http://www.pmwiki.org/wiki/PITS/01271 | Exploit Patch |
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2011-12-22 15:29
Updated : 2024-02-04 17:54
NVD link : CVE-2011-4453
Mitre link : CVE-2011-4453
CVE.ORG link : CVE-2011-4453
JSON object : View
Products Affected
pmwiki
- pmwiki
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')