PHP remote file include vulnerability in Yawp library 1.0.6 and earlier, as used in YaWiki and possibly other products, allows remote attackers to include arbitrary files via the _Yawp[conf_path] parameter.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Yawp | Yawp | 1.0.0 (including) | 1.0.0 (including) |
| Yawp | Yawp | 1.0.1 (including) | 1.0.1 (including) |
| Yawp | Yawp | 1.0.2 (including) | 1.0.2 (including) |
| Yawp | Yawp | 1.0.3 (including) | 1.0.3 (including) |
| Yawp | Yawp | 1.0.4 (including) | 1.0.4 (including) |
| Yawp | Yawp | 1.0.5 (including) | 1.0.5 (including) |
| Yawp | Yawp | 1.0.6 (including) | 1.0.6 (including) |
References
- http://phpyawp.com/yawiki/index.php?page=ChangeLog
- http://secunia.com/advisories/16049
- http://www.hardened-php.net/advisory-102005.php
- http://www.securityfocus.com/archive/1/404948
- http://www.securityfocus.com/bid/14237
- http://phpyawp.com/yawiki/index.php?page=ChangeLog
- http://secunia.com/advisories/16049
- http://www.hardened-php.net/advisory-102005.php
- http://www.securityfocus.com/archive/1/404948
- http://www.securityfocus.com/bid/14237