Re: [Full-disclosure] Tikiwiki 1.9.8 exploit ITW

To: Moritz Naumann <>
Cc: Full Disclosure <>,
Subject: Re: [Full-disclosure] Tikiwiki 1.9.8 exploit ITW

Dear Moritz Naumann,

This  vulnerability  was  found  by  ShAnKaR

and   reported   on  Bugtraq  yesterday  (see  "Vulnerabilities  digest"
message). TikiWiki developers were informed on October, 8.

--Friday, October 12, 2007, 1:20:06 AM, you wrote to

MN> Disabling url_fopen() or denying access to tiki-graph_formula.php for
MN> unauthenticated users will prevent your site from being exploited.

MN> I've notified the developers.

MN> If, what it says on is up to date (i.e.
MN> unfixed security issues of high priority initially reported 9 months
MN> ago), then you really should not use this software.

  ...       . ()

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -

Copyright © 1995-2018 All rights reserved.