3APA3A
15/10/07, 17:34
Dear Moritz Naumann,
This vulnerability was found by ShAnKaR
http://securityvulns.ru/Sdocument162.html
and reported on Bugtraq yesterday (see "Vulnerabilities digest"
message). TikiWiki developers were informed on October, 8.
--Friday, October 12, 2007, 1:20:06 AM, you wrote to full-disclosure@list=
s.grok.org.uk:
MN> Disabling url_fopen() or denying access to tiki-graph_formula.php for
MN> unauthenticated users will prevent your site from being exploited.
MN> I've notified the developers.
MN> If, what it says on http://dev.tikiwiki.org/Security is up to date (i=
..e.
MN> unfixed security issues of high priority initially reported 9 months
MN> ago), then you really should not use this software.
--=20
~/ZARAZA http://securityvulns.com/
=D7=E5=EB=EE=E2=E5=EA =FD=F2=EE =F2=E0=E9=ED=E0... =FF =E7=E0=ED=E8=EC=E0=
=FE=F1=FC =FD=F2=EE=E9 =F2=E0=E9=ED=EE=E9 =F7=F2=EE=E1=FB =E1=FB=F2=FC =F7=
=E5=EB=EE=E2=E5=EA=EE=EC. (=C4=EE=F1=F2=EE=E5=E2=F1=EA=E8=E9)
This vulnerability was found by ShAnKaR
http://securityvulns.ru/Sdocument162.html
and reported on Bugtraq yesterday (see "Vulnerabilities digest"
message). TikiWiki developers were informed on October, 8.
--Friday, October 12, 2007, 1:20:06 AM, you wrote to full-disclosure@list=
s.grok.org.uk:
MN> Disabling url_fopen() or denying access to tiki-graph_formula.php for
MN> unauthenticated users will prevent your site from being exploited.
MN> I've notified the developers.
MN> If, what it says on http://dev.tikiwiki.org/Security is up to date (i=
..e.
MN> unfixed security issues of high priority initially reported 9 months
MN> ago), then you really should not use this software.
--=20
~/ZARAZA http://securityvulns.com/
=D7=E5=EB=EE=E2=E5=EA =FD=F2=EE =F2=E0=E9=ED=E0... =FF =E7=E0=ED=E8=EC=E0=
=FE=F1=FC =FD=F2=EE=E9 =F2=E0=E9=ED=EE=E9 =F7=F2=EE=E1=FB =E1=FB=F2=FC =F7=
=E5=EB=EE=E2=E5=EA=EE=EC. (=C4=EE=F1=F2=EE=E5=E2=F1=EA=E8=E9)