CVE-2007-2025 File upload in n/a

High 7.5 Published 13 Apr 2007 Updated 7 Aug 2024

Remote attackers can upload arbitrary PHP files via double extensions in PhpWiki, leading to remote code execution.

Exploited in the wild: Not known
Login needed: Not stated
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2007-2025?

CVE-2007-2025 is a high-severity vulnerability in n/a, published on 13 Apr 2007. It can be exploited over the network, with no action from the victim.

Official description

Unrestricted file upload vulnerability in the UpLoad feature (lib/plugin/UpLoad.php) in PhpWiki 1.3.11p1 allows remote attackers to upload arbitrary PHP files with a double extension, as demonstrated by .php.3, which is interpreted by Apache as being a valid PHP file.

Which versions are affected by CVE-2007-2025?

It affects 1 product.

Products include Phpwiki Phpwiki.

How do I fix CVE-2007-2025?

Upgrade to a fixed version.

Is CVE-2007-2025 being exploited?

There is no known exploitation of CVE-2007-2025 in the wild and no public exploit code.

Sources

Also known as GHSA-48h3-fm9c-m4p8.