CVE-2011-4451

2012-09-0520:55:01

mitre

web.nvd.nist.gov

387

cve-2011-4451

wikkawiki

remote code execution

user-agent

http header

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

7.1

Confidence

Low

EPSS

0.009

Percentile

83.2%

JSON

libs/Wakka.class.php in WikkaWiki 1.3.1 and 1.3.2, when the spam_logging option is enabled, allows remote attackers to write arbitrary PHP code to the spamlog_path file via the User-Agent HTTP header in an addcomment request. NOTE: the vendor disputes this issue because the rendering of the spamlog_path file never uses the PHP interpreter

Affected configurations

Nvd

Node

wikkawikiwikkawikiMatch1.3.1

wikkawikiwikkawikiMatch1.3.2

VendorProductVersionCPE
wikkawikiwikkawiki1.3.1cpe:2.3:a:wikkawiki:wikkawiki:1.3.1:*:*:*:*:*:*:*
wikkawikiwikkawiki1.3.2cpe:2.3:a:wikkawiki:wikkawiki:1.3.2:*:*:*:*:*:*:*