medium6.8Public exploit code
CVE-2011-4449
actions/files/files.php in WikkaWiki 1.3.1 and 1.3.2, when INTRANET_MODE is enabled, supports file uploads for file extensions that are typically absent from a…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WikkaWiki 1.3.2 - Spam Logging PHP Injection (Metasploit)2012-05-12 · webapps · php · Verified
- WikkaWiki 1.3.2 - Multiple Vulnerabilities2011-11-30 · webapps · php
Impact
actions/files/files.php in WikkaWiki 1.3.1 and 1.3.2, when INTRANET_MODE is enabled, supports file uploads for file extensions that are typically absent from an Apache HTTP Server TypesConfig file, which makes it easier for remote attackers to execute arbitrary PHP code by placing this code in a file whose name has multiple extensions, as demonstrated by a (1) .mm or (2) .vpp file.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wikkawiki | Wikkawiki | Versions 1.3.1, 1.3.2 |