MediaWiki is one of famous wiki web applications. However, an input validation flaw in MediaWiki can cause malicious attackers to run arbitrary commands with the privilege of the HTTPD process, which is typically run as the nobody user.
Credit:
The information has been provided by SSR Team.
MediaWiki did not implement any type of check for multiple extensions of uploaded files, e.g. attack.php.rar. Therefore, a malicious attackers can upload arbitrary script files (PHP, pl, CGI, etc) to a web server and then execute them.
The vulnerability originates from the feature of Apache's MIME module (mod_mime), which regards attack.php.rar as a normal PHP file and executes the file through mod_php module with the privilege of the HTTPD process.
Disclosure Timeline:
2004-12-10 Vulnerability found.
2004-12-10 MediaWiki developer notified
2004-12-13 Update version released
2004-12-15 Official release
