From: 3APA3A (3APA3ASECURITY.NNOV.RU)
Date: Fri Oct 12 2007 - 05:23:02 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Dear Moritz Naumann,

This vulnerability was found by ShAnKaR

http://securityvulns.ru/Sdocument162.html

and reported on Bugtraq yesterday (see "Vulnerabilities digest"
message). TikiWiki developers were informed on October, 8.

--Friday, October 12, 2007, 1:20:06 AM, you wrote to full-disclosurelists.grok.org.uk:

MN> Disabling url_fopen() or denying access to tiki-graph_formula.php for
MN> unauthenticated users will prevent your site from being exploited.

MN> I've notified the developers.

MN> If, what it says on http://dev.tikiwiki.org/Security is up to date (i.e.
MN> unfixed security issues of high priority initially reported 9 months
MN> ago), then you really should not use this software.

--
~/ZARAZA http://securityvulns.com/
×åëîâåê ýòî òàéíà... ÿ çàíèìàþñü ýòîé òàéíîé ÷òîáû áûòü ÷åëîâåêîì. (Äîñòîåâñêèé)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]