Command Injection Vulnerability in Tuleap's PhpWiki Plugin by Tuleap

CVE-2017-7981

What is CVE-2017-7981?

The PhpWiki plugin in Tuleap versions before 9.7 is susceptible to a command injection flaw. This vulnerability arises from the use of the proc_open function, which allows an authenticated user to manipulate a syntax value, potentially including shell metacharacters. For example, an attacker could leverage this to execute arbitrary system commands, such as inserting a line like '<?plugin SyntaxHighlighter syntax="c;id"' to run the id command. This poses significant security risks as it enables unauthorized command execution within the server environment.

References