PmWiki <= 2.2.34 (pagelist.php) PHP Code Injection Vulnerability

Description:

PmWiki contains a vulnerability that allows a remote attacker to inject and execute arbitrary PHP code. The PageListSort() function defined in the scripts/pagelist.php script allows to inject arbitrary PHP code in a call to the create_function() PHP function via a crafted ‘order’ parameter of a pagelist directive.

References:

• CVE-2011-4453
• BID-50776
• EDB-18149
• http://www.pmwiki.org/wiki/PmWiki/ChangeLog#v2235

Disclosure Date:

November 23, 2011