Tiki Wiki CMS Groupware Eval Injection Vulnerability in Wiki Plugin Include Template

A vulnerability allowing eval injection has been identified in Tiki Wiki CMS Groupware versions prior to 28.3. The issue arises in the 'wikiplugin_includetpl' function within the 'wikiplugin_includetpl.php' file, where input is improperly sanitized before being evaluated. This flaw could be exploited by manipulating the 'filename' parameter to execute arbitrary PHP code.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server where Tiki is hosted.

Reproduction

To reproduce this vulnerability, use the 'wikiplugin_includetpl' function in a Tiki Wiki page or template. Pass a crafted 'filename' parameter that includes malicious PHP code. The lack of proper sanitization will allow the injected code to be executed on the server.

Remediation

Users are advised to upgrade to Tiki versions 21.12, 24.8, 27.2, or 28.3.