The debugenableplugins request parameter allows arbitrary
Perl code execution.
Using an HTTP GET request towards a TWiki server,
add a specially crafted debugenableplugins request parameter
to TWiki's view script (typically port 80/TCP).
Prior authentication may or may not be necessary.
A remote attacker can execute arbitrary Perl code
to view and modify any file the webserver user has access to.
Example: http://www.example.com/do/view/Main/WebHome?debugenableplugins=BackupRestorePlugin%3bprint("Content-Type:text/html\r\n\r\nVulnerable!")%3bexit
The TWiki site is vulnerable if you see a page with text
"Vulnerable!".