diff --git a/modules/exploits/unix/webapp/tikiwiki_graph_formula_exec.rb b/modules/exploits/unix/webapp/tikiwiki_graph_formula_exec.rb index 1661c707e3..a3e6a7cc2d 100644 --- a/modules/exploits/unix/webapp/tikiwiki_graph_formula_exec.rb +++ b/modules/exploits/unix/webapp/tikiwiki_graph_formula_exec.rb @@ -20,10 +20,12 @@ class Metasploit3 < Msf::Exploit::Remote super(update_info(info, 'Name' => 'TikiWiki tiki-graph_formula Remote PHP Code Execution', 'Description' => %q{ - TikiWiki (<= 1.9.8) contains a flaw that may allow a remote attacker to execute arbitrary commands. - The issue is due to 'tiki-graph_formula.php' script not properly sanitizing user input - supplied to the f variable, which may allow a remote attacker to execute arbitrary PHP - code resulting in a loss of integrity. + TikiWiki (<= 1.9.8) contains a flaw that may allow a remote + attacker to execute arbitrary PHP code. The issue is due to + 'tiki-graph_formula.php' script not properly sanitizing user + input supplied to create_function(), which may allow a remote + attacker to execute arbitrary PHP code resulting in a loss of + integrity. }, 'Author' => [ 'Matteo Cantoni ', 'jduck' ], 'License' => MSF_LICENSE,