Description
Direct static code injection vulnerability in wiki/index.php in Bitweaver 2.0.0 and earlier, when comments are enabled, allows remote attackers to inject arbitrary PHP code via an editcomments action.
References
- 40148 vdb-entry
- 3454 third-party-advisory
- http://www.hackerscenter.com/archive/view.asp?id=28129
- 20071209 Bitweaver XSS & SQL Injection Vulnerability mailing-list
- 3428 third-party-advisory
- 26801 vdb-entry