CVE-2011-4451

medium · 4.3

libs/Wakka.class.php in WikkaWiki 1.3.1 and 1.3.2, when the spam_logging option is enabled, allows remote attackers to write arbitrary PHP code to the spamlog_path file via the User-Agent HTTP header in an addcomment request. NOTE: the vendor disputes this issue because the rendering of the spamlog_path file never uses the PHP interpreter

4.3

CVSS

14.2%

EPSS (exploit prob.)

96th

EPSS percentile

2012-09-05

Published

AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

Vendor	Product	Affected versions
wikkawiki	wikkawiki	1.3.1
wikkawiki	wikkawiki	1.3.2

Check a specific version with /api/v1/cve/match.

References

http://wush.net/trac/wikka/ticket/1098
http://wush.net/trac/wikka/ticket/1098

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2011-4451