CVE-2007-5423: tiki tikiwiki_cms\/groupware Code Injection

CVSS: 7.5v2.0HighModified

Published 12-10-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-5423 is a high (CVSS 7.5) Code Injection vulnerability in tiki tikiwiki_cms\/groupware. EPSS estimates a 76.66% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 5 public exploits are recorded.

Overall risk

55/100

0100

High · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v2.0 (NVD)

EPSS score

76.66%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits5reference, exploit-database, metasploit

Timeline

12-10-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

tiki-graph_formula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP sequences in the f array parameter, which are processed by create_function.

CVSS metrics

1 score · 1 source · 1 version

v2.07.5

EPSS trend

Probability

76.66%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 76.66% on 19-09-2026

19-09-202619-10-2026

EPSS score

76.66%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

5 found

referenceUnverified
Exploit Reference (securityvulns.ru)
Maturity: unknown
referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown
exploit-databasephpVerified
TikiWiki 1.9.8 - Remote PHP Injection
Maturity: poc

Show all 5 exploits

exploit-databasephpVerified
TikiWiki tiki-graph_formula - PHP Remote Code Execution (Metasploit)
Maturity: poc
MetasploitremoteVerified
TikiWiki tiki-graph_formula Remote PHP Code Execution
exploit/unix/webapp/tikiwiki_graph_formula_exec
Maturity: weaponized