Dear Moritz Naumann, This vulnerability was found by ShAnKaR http://securityvulns.ru/Sdocument162.html and reported on Bugtraq yesterday (see "Vulnerabilities digest" message). TikiWiki developers were informed on October, 8. --Friday, October 12, 2007, 1:20:06 AM, you wrote to full-disclosure@xxxxxxxxxxxxxxxxx: MN> Disabling url_fopen() or denying access to tiki-graph_formula.php for MN> unauthenticated users will prevent your site from being exploited. MN> I've notified the developers. MN> If, what it says on http://dev.tikiwiki.org/Security is up to date (i.e. MN> unfixed security issues of high priority initially reported 9 months MN> ago), then you really should not use this software. -- ~/ZARAZA http://securityvulns.com/ Человек это тайна... я занимаюсь этой тайной чтобы быть человеком. (Достоевский)
