medium4.3Public exploit code
CVE-2011-4451
libs/Wakka.class.php in WikkaWiki 1.3.1 and 1.3.2, when the spam_logging option is enabled, allows remote attackers to write arbitrary PHP code to the spamlog_…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WikkaWiki 1.3.2 - Multiple Vulnerabilities2011-11-30 · webapps · php
Impact
libs/Wakka.class.php in WikkaWiki 1.3.1 and 1.3.2, when the spam_logging option is enabled, allows remote attackers to write arbitrary PHP code to the spamlog_path file via the User-Agent HTTP header in an addcomment request. NOTE: the vendor disputes this issue because the rendering of the spamlog_path file never uses the PHP interpreter
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wikkawiki | Wikkawiki | Versions 1.3.1, 1.3.2 |