CVE-2012-0911
- State
- Published
- Severity
- Not scored
- Published
- Jul 12, 2012
- Updated
- Aug 6, 2024
- Reserved
- Jan 23, 2012
Description
TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieName to lib/banners/bannerlib.php; (2) printpages or (3) printstructures parameter to (a) tiki-print_multi_pages.php or (b) tiki-print_pages.php; or (4) sendpages, (5) sendstructures, or (6) sendarticles parameter to tiki-send_objects.php, which is not properly handled when processed by the unserialize function.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 19630exploit
- 19573exploit
- http://info.tiki.org/article190-Tiki-Wiki-CMS-Groupware-Updates-Tiki-6-7-LTS
- 54298vdb-entry
- http://dev.tiki.org/item4109
- 83534vdb-entry
- 20120704 [CVE-2012-0911] Tiki Wiki CMS Groupware <= 8.3 "unserialize()" PHP Code Executionmailing-list
- tikiwiki-unserialize-code-exec(76758)vdb-entry
- http://info.tiki.org/article191-Tiki-Releases-8-4
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.