CVE-2006-4674: Code Injection
Published Sep 11, 2006
·Updated
Direct static code injection vulnerability in doku.php in DokuWiki before 2006-030-09c allows remote attackers to execute arbitrary PHP code via the X-FORWARDED-FOR HTTP header, which is stored in config.php.
Affected Software
27 affected components
Andreas Gohr Dokuwiki<=release_2006-03-09
Andreas Gohr Dokuwiki=release_2004-07-04
Andreas Gohr Dokuwiki=release_2004-07-07
Andreas Gohr Dokuwiki=release_2004-07-12
Andreas Gohr Dokuwiki=release_2004-07-21
Andreas Gohr Dokuwiki=release_2004-07-25
Andreas Gohr Dokuwiki=release_2004-08-08
Andreas Gohr Dokuwiki=release_2004-08-15a
Andreas Gohr Dokuwiki=release_2004-08-22
Andreas Gohr Dokuwiki=release_2004-09-12
Andreas Gohr Dokuwiki=release_2004-09-25
Andreas Gohr Dokuwiki=release_2004-09-30
Andreas Gohr Dokuwiki=release_2004-10-19
Andreas Gohr Dokuwiki=release_2004-11-01
Andreas Gohr Dokuwiki=release_2004-11-02
Andreas Gohr Dokuwiki=release_2004-11-10
Andreas Gohr Dokuwiki=release_2005-01-14
Andreas Gohr Dokuwiki=release_2005-01-15
Andreas Gohr Dokuwiki=release_2005-01-16a
Andreas Gohr Dokuwiki=release_2005-02-06
Andreas Gohr Dokuwiki=release_2005-02-18
Andreas Gohr Dokuwiki=release_2005-05-07
Andreas Gohr Dokuwiki=release_2005-07-01
Andreas Gohr Dokuwiki=release_2005-07-13
Andreas Gohr Dokuwiki=release_2005-09-19
Andreas Gohr Dokuwiki=release_2005-09-22
Andreas Gohr Dokuwiki=release_2006-03-05
Remediation
Patch Available
Event History
Sep 11, 2006
CVE Published
05:04 PM
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2006-4674?
The severity of CVE-2006-4674 is classified as critical due to the potential for remote code execution.
2
How do I fix CVE-2006-4674?
To fix CVE-2006-4674, upgrade DokuWiki to a version released after 2006-03-09.
3
What versions of DokuWiki are affected by CVE-2006-4674?
Versions of DokuWiki released before 2006-03-09 are affected by CVE-2006-4674.
4
What type of vulnerability is CVE-2006-4674?
CVE-2006-4674 is a direct static code injection vulnerability.
5
What is the impact of CVE-2006-4674 on a DokuWiki installation?
CVE-2006-4674 allows attackers to execute arbitrary PHP code on affected DokuWiki installations.