CVE-2008-3195
TWiki < 4.2.3 - Path Traversal and Arbitrary File Execution via Image Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2008-3195. PoCs published by Th1nk3r.
AI-analyzed exploit summary This exploit leverages an input validation error in TWiki 4.2.0's configure script to disclose arbitrary files by manipulating the 'image' and 'type' parameters. The vulnerability arises from insufficient sanitization of user-supplied input in the open() function.
Description
Directory traversal vulnerability in bin/configure in TWiki before 4.2.3, when a certain step in the installation guide is skipped, allows remote attackers to read arbitrary files via a query string containing a .. (dot dot) in the image variable, and execute arbitrary files via unspecified vectors.
Exploits (2)
This exploit leverages an input validation error in TWiki 4.2.0's configure script to disclose arbitrary files by manipulating the 'image' and 'type' parameters. The vulnerability arises from insufficient sanitization of user-supplied input in the open() function.
The exploit demonstrates a local file inclusion and command execution vulnerability in TWiki's 'configure' script due to improper handling of user-supplied input in the 'image' parameter. The vulnerability allows arbitrary file reads and command execution via shell metacharacters.