CVE-2009-4090
telepark.wiki < 2.4.23 - Remote Code Execution via NULL Byte in File Upload
Title source: llmDescription
Unrestricted file upload vulnerability in ajax/addComment.php in telepark.wiki 2.4.23 and earlier script allows remote attackers to execute arbitrary code by uploading a file with a name containing a NULL byte.
References (5)
Core 5
Core References
Patch x_refsource_confirm
http://blog.telepark.com/telepark-web-software/2009/11/09/telepark-wiki-security-fixes/
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://www.osvdb.org/60219
Exploit, Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/37391
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/54294
Exploit x_refsource_misc
http://packetstormsecurity.org/0911-exploits/Telepark-fixes-nov09-2.txt
Scores
EPSS
0.0321
EPSS Percentile
86.7%
Details
CWE
CWE-20
Status
published
Products (1)
telepark/telepark.wiki
< 2.4.23
Published
Nov 29, 2009
Tracked Since
Feb 18, 2026