TWiki ImageGalleryPlugin Shell Command Injection
- 0
- Add a Comment
- No Related Post
Critical: Moderately critical
Impact: System access
Where: From remote
Solution Status: Unpatched
Software: ImageGalleryPlugin 1.x (TWiki plugin)
Select a product and view a complete list of all Patched/Unpatched Secunia advisories affecting it.
CVE reference: CAN-2005-0516
Description:
Florian Weimer has reported a vulnerability in the TWiki Image Gallery plugin, which can be exploited by malicious users to compromise a vulnerable system.
The problem is that some configuration options used in ImageMagick commands can be manipulated. This can be exploited to inject arbitrary shell commands.
Successful exploitation requires that a user can create or edit image galleries.
Solution:
Edit the source code to ensure that input is properly sanitised”
Full article: Secunia Advisory: SA14384