CVE-2011-4450

CVE-2011-4450 affects WikkaWiki 1.3.1 and 1.3.2. The vulnerability is a directory traversal in handlers/files.xml/files.xml.php that lets remote attackers read or delete arbitrary files by supplying a path with a non-initial .. in the file parameter (example: /../../wikka.config.php during a down...

CVE-2011-4452

CVE-2011-4452 describes a CSRF vulnerability in WikkaWiki 1.3.1–1.3.2, specifically in the AdminUsers component. An attacker can lure an admin to visit a malicious page containing an image action that triggers delete requests, potentially hijacking the administrator’s session and removing arbitra...

CVE-2011-4452

Cross-site request forgery CSRF vulnerability in the AdminUsers component in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to hijack the authentication of administrators for requests that remove arbitrary user accounts via a delete operation, as demonstrated by an image action...

CVE-2011-4448

SQL injection vulnerability in actions/usersettings/usersettings.php in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to execute arbitrary SQL commands via the defaultcommentdisplay parameter in an update action...

CVE-2011-4451

WikkaWiki 1.3.1 and 1.3.2 are affected by a remote PHP code injection vulnerability in the spam-logging path when spam_logging is enabled. The issue allows an attacker to supply PHP code via the User-Agent header in addcomment requests to write to the spamlog_path file. Vendor disputes this issue...

CVE-2011-4450

Directory traversal vulnerability in handlers/files.xml/files.xml.php in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to read or delete arbitrary files via a non-initial .. dot dot in the file parameter, as demonstrated by the /../../wikka.config.php pathname in a download action...

CVE-2011-4451

libs/Wakka.class.php in WikkaWiki 1.3.1 and 1.3.2, when the spamlogging option is enabled, allows remote attackers to write arbitrary PHP code to the spamlogpath file via the User-Agent HTTP header in an addcomment request. NOTE: the vendor disputes this issue because the rendering of the...

CVE-2011-4448

CVE-2011-4448 affects WikkaWiki 1.3.1 and 1.3.2. The vulnerability is an SQL injection in actions/usersettings/usersettings.php via the default_comment_display parameter in an update action, caused by insufficient sanitization. This allows remote attackers to inject arbitrary SQL commands and pot...

PT-2012-1885 · Wikkawiki · Wikkawiki

Name of the Vulnerable Software and Affected Versions: WikkaWiki versions 1.3.1 through 1.3.2 Description: The issue allows remote attackers to write arbitrary PHP code to the spamlog path file via the User-Agent HTTP header in an addcomment request when the spam logging option is enabled. The...

WikkaWiki 1.3.2 Spam Logging PHP Injection

Exploit for php platform in category web applications This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

WikkaWiki 1.3.2 - Spam Logging PHP Injection (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "WikkaWiki 1.3.2...

WikkaWiki 1.3.2 Spam Logging PHP Injection

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "WikkaWiki 1.3.2...

WikkaWiki <= 1.3.2 Multiple Security Vulnerabilities

---------------------------------------------------- WikkaWiki = 1.3.2 Multiple Security Vulnerabilities ---------------------------------------------------- author............: Egidio Romano aka EgiX mail..............: n0b0d13satgmaildotcom software link.....: http://wikkawiki.org/...

WikkaWiki Multiple Security Vulnerabilities

WikkaWiki is prone to multiple security vulnerabilities, including: 1. An SQL injection vulnerability. 2. An arbitrary file upload vulnerability. 3. An arbitrary file deletion vulnerability. 4. An arbitrary file download vulnerability. 5. A PHP code injection vulnerability. Attackers can exploit...

WikkaWiki <= 1.3.2 Multiple Security Vulnerabilities

No description provided by source. ---------------------------------------------------- WikkaWiki = 1.3.2 Multiple Security Vulnerabilities ---------------------------------------------------- author............: Egidio Romano aka EgiX mail..............: n0b0d13satgmaildotcom software link.....:...

WikkaWiki Multiple Security Vulnerabilities

WikkaWiki is prone to multiple security vulnerabilities, including: - An SQL injection vulnerability. - An arbitrary file upload vulnerability. - An arbitrary file deletion vulnerability. - An arbitrary file download vulnerability. - A PHP code injection vulnerability. SPDX-FileCopyrightText: 201...

WikkaWiki 1.3.2 Code Execution / Shell Upload / SQL Injection

---------------------------------------------------- WikkaWiki Query" 142. UPDATE ".$this-GetConfigValue'tableprefix'."users 143. SET email = '".mysqlrealescapestring$email."', 144. doubleclickedit = '".mysqlrealescapestring$doubleclickedit."', 145. showcomments =...

WikkaWiki 1.3.2 Spam Logging PHP Injection

This module exploits a vulnerability found in WikkaWiki. When the spam logging feature is enabled, it is possible to inject PHP code into the spam log file via the UserAgent header, and then request it to execute our payload. There are at least three different ways to trigger spam protection, thi...

WikkaWiki 1.3.2 - Multiple Vulnerabilities

---------------------------------------------------- WikkaWiki Query" 142. UPDATE ".$this-GetConfigValue'tableprefix'."users 143. SET email = '".mysqlrealescapestring$email."', 144. doubleclickedit = '".mysqlrealescapestring$doubleclickedit."', 145. showcomments =...

WikkaWiki 1.3.2 - Multiple Vulnerabilities

WikkaWiki 1.3.2 - Multiple Vulnerabilities ---------------------------------------------------- WikkaWiki Query" 142. UPDATE ".$this-GetConfigValue'tableprefix'."users 143. SET email = '".mysqlrealescapestring$email."', 144. doubleclickedit = '".mysqlrealescapestring$doubleclickedit."', 145...