CVE:CVE-2008-6423
CNNVD:CNNVD-200903-133
PassWiki 0.9.16 RC3及其早期版本的passwiki.php中存在目录遍历漏洞。远程攻击者可以借助site_id参数中的一个..,读取任意本地文件。
solution:Upgrade i-apps passwiki to a higher version than *:rc3,0.9.3,0.9.5,0.9.6,0.9.7,0.9.8,0.9.9,0.9.10,0.9.11,0.9.12,0.9.13,0.9.14,0.9.15,0.9.15:beta,0.9.15:beta2,0.9.15:rc1,0.9.16:beta1,0.9.16:beta2,0.9.16:beta3,0.9.16:rc1,0.9.16:rc2,and avoid the version *:rc3,0.9.3,0.9.5,0.9.6,0.9.7,0.9.8,0.9.9,0.9.10,0.9.11,0.9.12,0.9.13,0.9.14,0.9.15,0.9.15:beta,0.9.15:beta2,0.9.15:rc1,0.9.16:beta1,0.9.16:beta2,0.9.16:beta3,0.9.16:rc1,0.9.16:rc2