CVE-2006-0479
PmWiki 2.1 beta 20 - Remote File Inclusion and Cross-Site Scripting via Global Variable Bypass
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-0479. PoCs published by aScii.
AI-analyzed exploit summary The provided text describes multiple input-validation vulnerabilities in PmWiki, including an arbitrary remote file-include vulnerability and unspecified HTML-injection issues. It includes a proof-of-concept URL demonstrating the file-include vulnerability.
Description
pmwiki.php in PmWiki 2.1 beta 20, with register_globals enabled, allows remote attackers to bypass protection mechanisms that deregister global variables by setting both a GPC variable and a GLOBALS[] variable with the same name, which causes PmWiki to unset the GLOBALS[] variable but not the GPC variable, which creates resultant vulnerabilities such as remote file inclusion and cross-site scripting (XSS).
Exploits (1)
The provided text describes multiple input-validation vulnerabilities in PmWiki, including an arbitrary remote file-include vulnerability and unspecified HTML-injection issues. It includes a proof-of-concept URL demonstrating the file-include vulnerability.