CVE-2011-4449

This Metasploit module exploits a PHP code injection vulnerability in WikkaWiki 1.3.2 by injecting malicious PHP code into the spam log file via the UserAgent header. The exploit triggers spam logging by generating fake URLs in a comment and then executes the payload by accessing the spam log file.

This is a detailed technical analysis of multiple vulnerabilities in WikkaWiki <= 1.3.2, including SQL injection, unrestricted file upload, arbitrary file download/deletion, and remote code execution. The writeup provides proof-of-concept requests and explains the root causes of each vulnerability.