CVE-2002-2106

PHP <0.21 - RCE

Title source: llm
STIX 2.1

Description

PHP remote file inclusion vulnerability in WikkiTikkiTavi before 0.21 allows remote attackers to execute arbitrary PHP code via the TemplateDir variable, as demonstrated using conflict.php.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Scott Moonen · textwebappsphp
https://www.exploit-db.com/exploits/21241

References (4)

Core 4
Core References
Exploit, Patch vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/3946
Exploit, Patch vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1003307
Exploit, Vendor Advisory mailing-list x_refsource_mlist
http://sourceforge.net/mailarchive/message.php?msg_id=185752
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/8001

Scores

EPSS 0.0360
EPSS Percentile 87.9%

Details

Status published
Products (3)
wikkitikkitavi/wikkitikkitavi 0.5
wikkitikkitavi/wikkitikkitavi 0.10
wikkitikkitavi/wikkitikkitavi 0.20
Published Dec 31, 2002
Tracked Since Feb 18, 2026