Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
MediaWiki Improper Input Validation Vulnerability - CVE-2014-1610 - Vulnerability Database
MediaWiki

MediaWiki Improper Input Validation Vulnerability - CVE-2014-1610

Medium
Reference: CVE-2014-1610
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2014-1610
Title: MediaWiki Improper Input Validation Vulnerability
Overview:

MediaWiki 1.22.x before 1.22.2 1.21.x before 1.21.5 and 1.19.x before 1.19.11 when DjVu or PDF file upload support is enabled allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php (2) the w parameter (aka width field) to thumb.php which is not properly handled by includes/media/PdfHandler_body.php and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.