PT-2012-1883 · Wikkawiki+1 · Wikkawiki+1

Published 2012-09-05 · Updated 2012-09-07 · CVE-2011-4449

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WikkaWiki versions 1.3.1 through 1.3.2

Description The issue allows remote attackers to execute arbitrary PHP code by uploading files with specific extensions, such as .mm or .vpp, when INTRANET MODE is enabled. This is possible because the affected software supports file uploads for file extensions that are typically not present in an Apache HTTP Server TypesConfig file.

Recommendations For WikkaWiki versions 1.3.1 and 1.3.2, consider disabling the file upload feature when INTRANET MODE is enabled until a patch is available. Restrict access to the actions/files/files.php script to minimize the risk of exploitation. Avoid using file extensions that are not explicitly defined in the Apache HTTP Server TypesConfig file.

Exploit

Fix

Related Identifiers

CVE-2011-4449

Affected Products

Apache Http Server

Wikkawiki

References · 5

• 🔥 http://wush.net/trac/wikka/changeset/1822 · Exploit
• 🔥 https://exploit-db.com/exploits/18177 · Exploit
• 🔥 https://exploit-db.com/exploits/18865 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-4449 · Security Note
• http://wush.net/trac/wikka/ticket/1097 · Vendor Advisory