CVE-2014-5519
high
CVSS v3
—
VIR risk
7.5
Description
The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the edit[content] parameter to index.php/HeIp. NOTE: some of these details are obtained from third party information.
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| phpwiki_project | phpwiki | 1.5.0 | |
References
- http://osvdb.org/show/osvdb/110576
- http://packetstormsecurity.com/files/128031/PhpWiki-Ploticus-Command-Injection.html
- http://seclists.org/fulldisclosure/2014/Aug/77
- http://seclists.org/oss-sec/2014/q3/456
- http://seclists.org/oss-sec/2014/q3/465
- http://secunia.com/advisories/60293
- http://www.exploit-db.com/exploits/34451
- http://osvdb.org/show/osvdb/110576
- http://packetstormsecurity.com/files/128031/PhpWiki-Ploticus-Command-Injection.html
- http://seclists.org/fulldisclosure/2014/Aug/77
- http://seclists.org/oss-sec/2014/q3/456
- http://seclists.org/oss-sec/2014/q3/465
- http://secunia.com/advisories/60293
- http://www.exploit-db.com/exploits/34451
CWEs
CWE-94
💬 Discuss CVE-2014-5519 on VIR Community →
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.