CVE-2007-5423: TikiWiki tiki-graph_formula.php PHP code injection via f parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a very high EPSS score and public exploit references makes this an urgent patch-or-mitigate case.

What it is

TikiWiki 1.9.8 passes the f array parameter from tiki-graph_formula.php into PHP's create_function, allowing injected PHP sequences to be evaluated as code. This is a remote, unauthenticated code execution flaw in a web-exposed component, so any reachable instance is at serious risk.

Impact

An attacker can execute arbitrary PHP code in the context of the web server, leading to full compromise of the TikiWiki host and its data. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as partial.

Attack surface

Reached over the network through HTTP requests to tiki-graph_formula.php with a crafted f array parameter. The CVSS 2.0 vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.76661 (99.5th percentile) and multiple references carry the Exploit tag, indicating public exploit material exists.

What to do

• Upgrade TikiWiki to a fixed release; the referenced Gentoo GLSA and SourceForge release notes document the vendor fix.
• If immediate upgrade is not possible, remove or disable tiki-graph_formula.php and restrict access to it at the web server.
• Apply the Gentoo GLSA-200710-21 package update if running the Gentoo-packaged version.
• Run the TikiWiki web service with least privilege and isolate it from sensitive internal networks.
• Audit the instance for prior compromise, since code execution may already have occurred.

Detection

• Inspect web logs for requests to tiki-graph_formula.php with unusual f array parameters containing PHP function or code syntax.
• Monitor for PHP process behavior such as unexpected child processes, file writes, or outbound connections from the web server.
• Search for known exploit payload strings from the referenced Exploit-DB and SecurityFocus entries in HTTP request bodies and query strings.
• Review file integrity on the TikiWiki installation for modified or newly created PHP files.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.