PT-2012-1883 · Wikkawiki+1 · Wikkawiki+1

Publicado 2012-09-05 · Atualizado 2012-09-07 · CVE-2011-4449

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WikkaWiki versions 1.3.1 through 1.3.2

Description The issue allows remote attackers to execute arbitrary PHP code by uploading files with specific extensions, such as .mm or .vpp, when INTRANET MODE is enabled. This is possible because the affected software supports file uploads for file extensions that are typically not present in an Apache HTTP Server TypesConfig file.

Recommendations For WikkaWiki versions 1.3.1 and 1.3.2, consider disabling the file upload feature when INTRANET MODE is enabled until a patch is available. Restrict access to the actions/files/files.php script to minimize the risk of exploitation. Avoid using file extensions that are not explicitly defined in the Apache HTTP Server TypesConfig file.

Exploit

Correção

Identificadores relacionados

CVE-2011-4449

Produtos afetados

Apache Http Server

Wikkawiki

Referências · 5

• 🔥 http://wush.net/trac/wikka/changeset/1822 · Exploit
• 🔥 https://exploit-db.com/exploits/18177 · Exploit
• 🔥 https://exploit-db.com/exploits/18865 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-4449 · Nota de Segurança
• http://wush.net/trac/wikka/ticket/1097 · Aviso do Fabricante