FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2009-1960

This CVE name corresponds to:

Entered	Topic
2009-06-04	dokuwiki -- Local File Inclusion with register_globals on

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2009-1960 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2009-1960
Phase	Assigned(20090606)

Description

inc/init.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via the config_cascade[main][default][] parameter to doku.php. NOTE: PHP remote file inclusion is also possible in PHP 5 using ftp:// URLs.

References

Source	Reference
MILW0RM	8781
MILW0RM	8812
CONFIRM	http://bugs.splitbrain.org/index.php?do=details&task_id=1700
CONFIRM	http://dev.splitbrain.org/darcsweb/darcsweb.cgi?r=dokuwiki;a=commitdiff;h=20090526145030-7ad00-c0483e021f47898c8597f3bfbdd26c637f891d86.gz
BID	35095
SECUNIA	35218