Vulnerabilities > CVE-2005-2877 - Unspecified vulnerability in Twiki

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
twiki
nessus
exploit available
metasploit
NVD
Published: 2005-09-16
Updated: 2024-11-21

Summary

The history (revision control) function in TWiki 02-Sep-2004 and earlier allows remote attackers to execute arbitrary code via shell metacharacters, as demonstrated via the rev parameter to TWikiUsers.

Vulnerable Configurations

Part Description Count
Application
Twiki
5

Exploit-Db

  • descriptionTWiki History TWikiUsers rev Parameter Command Execution. CVE-2005-2877. Webapps exploit for php platform
    idEDB-ID:16892
    last seen2016-02-02
    modified2010-07-03
    published2010-07-03
    reportermetasploit
    sourcehttps://www.exploit-db.com/download/16892/
    titleTWiki History TWikiUsers rev Parameter Command Execution
  • descriptionTWiki TWikiUsers INCLUDE Function Remote Arbitrary Command Execution Vulnerability. CVE-2005-2877. Webapps exploit for php platform
    idEDB-ID:26302
    last seen2016-02-03
    modified2005-09-28
    published2005-09-28
    reporterJChristophFuchs
    sourcehttps://www.exploit-db.com/download/26302/
    titleTWiki TWikiUsers INCLUDE Function Remote Arbitrary Command Execution Vulnerability

Metasploit

descriptionThis module exploits a vulnerability in the history component of TWiki. By passing a 'rev' parameter containing shell metacharacters to the TWikiUsers script, an attacker can execute arbitrary OS commands.
idMSF:EXPLOIT/UNIX/WEBAPP/TWIKI_HISTORY
last seen2020-02-29
modified2017-07-24
published2010-02-21
references
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/unix/webapp/twiki_history.rb
titleTWiki History TWikiUsers rev Parameter Command Execution

Nessus

NASL familyCGI abuses
NASL idTWIKI_REV_CMD_EXEC.NASL
descriptionThe version of TWiki running on the remote host allows an attacker to manipulate input to the
last seen2020-06-01
modified2020-06-02
plugin id19704
published2005-09-15
reporterThis script is Copyright (C) 2005-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/19704
titleTWiki 'rev' Parameter Arbitrary Command Execution

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/86538/twiki_history.rb.txt
idPACKETSTORM:86538
last seen2016-12-05
published2010-02-23
reporterB4dP4nd4
sourcehttps://packetstormsecurity.com/files/86538/TWiki-History-TWikiUsers-rev-Parameter-Command-Execution.html
titleTWiki History TWikiUsers rev Parameter Command Execution

Saint

bid14834
descriptionTWiki revision control shell command injection
idweb_prog_cgi_twikirev
osvdb19403
titletwiki_rev
typeremote

References