BID:11985

MediaWiki Remote Arbitrary Script Upload Vulnerability

Info

MediaWiki Remote Arbitrary Script Upload Vulnerability

Bugtraq ID:	11985
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 16 2004 12:00AM
Updated:	Dec 16 2004 12:00AM
Credit:	Discovery is credited to Jeremy Bae of STG Security.
Vulnerable:	MediaWiki MediaWiki 1.3.8 MediaWiki MediaWiki 1.3.7 MediaWiki MediaWiki 1.3.6 MediaWiki MediaWiki 1.3.5 MediaWiki MediaWiki 1.3.4 MediaWiki MediaWiki 1.3.3 MediaWiki MediaWiki 1.3.2 MediaWiki MediaWiki 1.3.1 MediaWiki MediaWiki 1.3

Not Vulnerable:	MediaWiki MediaWiki 1.3.9

Discussion

MediaWiki Remote Arbitrary Script Upload Vulnerability

MediaWiki is reported prone to a vulnerability that can allow a remote attacker to upload arbitrary PHP scripts to a vulnerable server. This issue results from insufficient sanitization of user-supplied input.

If successful, the attacker can execute arbitrary script code on a vulnerable server. This can lead to unauthorized access in the context of the application.

MediaWiki 1.3.8 and prior versions are affected by this issue.

Exploit / POC

MediaWiki Remote Arbitrary Script Upload Vulnerability

An exploit is not required.

The following proof of concept is available:
Script file name:
attack.php.rar

Solution / Fix

MediaWiki Remote Arbitrary Script Upload Vulnerability

Solution:
The vendor has released MediaWiki 1.3.9 to address this issue:

MediaWiki MediaWiki 1.3