Vulnerability record · CVE-2014-5519 · published 11 September 2014
CVE-2014-5519: PhpWiki Ploticus module command injection via device option
Phpwiki Project · Phpwiki
PhpWiki 1.5.0 passes shell metacharacters from the edit[content] parameter of index.php/HeIp into the Ploticus module without sanitization, allowing command injection. Because the vulnerable path is reachable remotely and unauthenticated, it exposes wiki hosts to arbitrary code execution. The record notes some details come from third-party information, so the exact code path is not fully documented here.
Description
The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the edit[content] parameter to index.php/HeIp. NOTE: some of these details are obtained from third party information.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityUnauthenticated remote code execution with public exploit code and very high EPSS probability, though not listed in CISA KEV.
What it is
PhpWiki 1.5.0 passes shell metacharacters from the edit[content] parameter of index.php/HeIp into the Ploticus module without sanitization, allowing command injection. Because the vulnerable path is reachable remotely and unauthenticated, it exposes wiki hosts to arbitrary code execution. The record notes some details come from third-party information, so the exact code path is not fully documented here.
Impact
An attacker can execute arbitrary operating system commands with the privileges of the web server, leading to full compromise of the PhpWiki host and any data it can reach.
Attack surface
Reached over the network through index.php/HeIp with a crafted edit[content] parameter containing shell metacharacters in a device option; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.
Exploitation
Multiple public references are tagged Exploit, including Packet Storm, Full Disclosure, oss-sec and Exploit-DB entries, so working exploit code is publicly available; the CVE is not in CISA KEV, while EPSS shows a 30-day probability of 0.64971 (99.2nd percentile).
What to do
- Upgrade or patch PhpWiki to a version that fixes the Ploticus command injection; if no fixed release is available, remove or disable the Ploticus module.
- Restrict network access to PhpWiki instances so only trusted users or internal networks can reach index.php.
- Run the web server and PHP under a low-privilege account with no shell access and limited filesystem permissions.
- Deploy a WAF or input filter that blocks shell metacharacters in the edit[content] parameter and similar request fields.
Detection
- Search web server and application logs for requests to index.php/HeIp containing shell metacharacters such as ;, |, $(), backticks or && in the edit[content] parameter.
- Monitor for unexpected child processes spawned by the web server or PHP process, especially ploticus or shell interpreters.
- Alert on outbound network connections or file writes originating from the PhpWiki process that are not part of normal wiki operation.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2014-5519 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2014-5519), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
