Description
Eval injection vulnerability in MediaWiki 1.5.x before 1.5.3 allows remote attackers to execute arbitrary PHP code via the "user language option," which is used as part of a dynamic class name that is processed using the eval function.
References
- http://sourceforge.net/project/shownotes.php?group_id=34373&release_id=375755
- 17866 third-party-advisory
- 15703 vdb-entry
- ADV-2005-2726 vdb-entry
- VU#392156 third-party-advisory