CVE-2008-1170 in KCWiki
Summary
by MITRE
Multiple PHP remote file inclusion vulnerabilities in KCWiki 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the page parameter to (1) minimal/wiki.php and (2) simplest/wiki.php.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/30/2025
The vulnerability described in CVE-2008-1170 represents a critical remote file inclusion flaw affecting KCWiki 1.0, a content management system for wiki applications. This vulnerability stems from improper input validation within the application's handling of user-supplied parameters, specifically the page parameter that is processed in two distinct files. The flaw allows malicious actors to inject arbitrary URLs into the application's execution flow, potentially enabling complete system compromise through remote code execution.
The technical implementation of this vulnerability aligns with CWE-88, which describes improper neutralization of special elements used in an SQL command, and more specifically CWE-94, which covers execution of arbitrary code through the use of dynamic code generation. The vulnerability manifests when the application accepts user input through the page parameter without adequate sanitization or validation, permitting attackers to supply URLs that point to malicious PHP scripts hosted on remote servers. This allows the web application to include and execute foreign code, effectively granting attackers unauthorized access to the server's execution environment.
The operational impact of this vulnerability is severe and multifaceted, encompassing potential data breaches, system compromise, and complete loss of control over affected servers. Attackers exploiting this vulnerability can execute arbitrary commands on the target system, potentially leading to unauthorized access to sensitive data, installation of backdoors, or use of compromised systems as launching points for further attacks. The vulnerability affects the core functionality of the wiki application and can be leveraged to establish persistent access to the underlying infrastructure, making it particularly dangerous for organizations relying on this software for content management.
From a threat modeling perspective, this vulnerability maps to several ATT&CK techniques including T1059.007 for execution through PHP and T1190 for exploitation of remote services. The attack vector requires minimal technical sophistication and can be automated using existing exploitation frameworks, making it particularly dangerous in environments where the software is widely deployed. Organizations should prioritize immediate patching of affected systems, implement proper input validation mechanisms, and consider network-level restrictions to prevent unauthorized access to vulnerable applications. The vulnerability demonstrates the critical importance of validating all user inputs and implementing proper access controls to prevent unauthorized code execution in web applications.
Mitigation strategies should include immediate application updates to versions that address the vulnerability, implementation of web application firewalls to detect and block malicious requests, and comprehensive security audits of all web applications to identify similar vulnerabilities. Additionally, organizations should enforce strict input validation practices, implement proper parameter sanitization, and establish monitoring procedures to detect unusual access patterns that may indicate exploitation attempts. The vulnerability serves as a reminder of the critical need for regular security assessments and the importance of keeping web applications updated with the latest security patches to prevent exploitation of known vulnerabilities.