CVE-2012-0911
Critical
Description
TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieName to lib/banners/bannerlib.php; (2) printpages or (3) printstructures parameter to (a) tiki-print_multi_pages.php or (b) tiki-print_pages.php; or (4) sendpages, (5) sendstructures, or (6) sendarticles parameter to tiki-send_objects.php, which is not properly handled when processed by the unserialize function.
SeverityCritical
CVSS9.8
Exploit probability—
ProductTikiwiki Cms\/groupware
PublishedJul 12, 2012
First seenJul 12, 2012
How to fix
Update
- tiki tikiwiki_cms\/groupware6.7, 8.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tiki tikiwiki_cms\/groupware | v < 6.7, v < 8.4 | 6.7, 8.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.