WikkaWiki Multiple Vulnerabilities
Release Date 2011-12-02
Last Update 2012-09-11
Criticality level : Highly critical
Impact : Cross Site Scripting
Manipulation of data
Exposure of sensitive information
System access
Where : From remote
Solution Status :Vendor Patch
Software: WikkaWiki 1.x
Description:
A weakness and multiple vulnerabilities have been discovered in WikkaWiki, which can be exploited by malicious users to manipulate certain data, conduct SQL injection attacks, and compromise a vulnerable system and by malicious people to disclose potentially sensitive information, conduct cross-site request forgery attacks, and compromise a vulnerable system.
1) The application allows users to perform certain actions via HTTP requests without performing proper validity checks to verify the requests. This can be exploited to e.g. delete a user when a logged-in administrative user visits a specially crafted web page.
2) Input passed via the "file" POST parameter to wikka.php (when "wakka" is set to a wiki page with "{{files}}" directive and "action" is set to "delete") is not properly verified before being used to delete files. This can be exploited to delete arbitrary files via directory traversal attacks.
Successful exploitation requires administrative rights.
3) Input passed via the "file" parameter to wikka.php (when "wakka" is set to a page with "{{files}}" directive and "action" is set to "download") is not properly verified before being used to download files. This can be exploited to download arbitrary files via directory traversal attacks.
4) Input passed via the "default_comment_display" parameter to wikka.php (when "wakka" is set to "UserSettings" and "action" is set to "update") is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
5) Input passed via the "file" POST parameter to wikka.php (when "wakka" is set to a wiki page with "{{files}}" directive and "upload" is set to "Upload") is not properly verified before being used to upload files. This can be exploited to e.g. upload and execute arbitrary PHP files with an e.g. ".php.mm" extension.
Successful exploitation requires administrative rights or "INTRANET_MODE" to be enabled (disabled by default) and that Apache is not configured to handle the mime-type for files with e.g. a ".mm" extension.
6) Input passed via the "User-Agent" header to wikka.php (when "wakka" is set to a wiki page and appended "/addcomment") is not properly sanitised before being written to a certain file. This can be exploited to inject and potentially execute arbitrary commands.
Successful exploitation requires access rights to post comments, "spam_logging" to be enabled (disabled by default), and "spamlog_path" to be set to a file name suitable for PHP execution by the web server ("spamlog.txt.php" by default).
The vulnerabilities are confirmed in version 1.3.2. Other versions may also be affected.
Solution:
Update to version 1.3.2-p7.
Provided and/or discovered by:
Egidio Romano aka EgiX
Original Advisory:
Exploit-DB:
http://www.exploit-db.com/exploits/18177/
WikkaWiki:
http://blog.wikkawiki.org/2011/12/04/security-updates-for-1-3-11-3-2/
http://secunia.com/advisories/47034
Was this reply helpful? (0) (0)
Staff pick
Manage updates with the Download App
- 9/11/12 7:14 AM 
Unread
Read
Locked thread
Moderator
CNET Staff
Samsung Staff
Norton Authorized Support Team
AVG Staff
avast! Staff
Webroot Support Team
Acer Customer Experience Team
Windows Outreach Team
Dell Staff
Intel Staff
Question
Resolved question
General discussion
Tip
Alert or warning
Praise
Rant