HTB23170: WikkaWiki 1.3.4 XSS vulnerability

WikkaWiki version 1.3.4 is vulnerable to perform cross-site scripting attack, described in HTB23170 security advisory. The vulnerability exists due to insufficient sanitisation of user-supplied data in "wakka" HTTP GET parameter passed to "/sql/" URL. A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website. Exploit example is available on security research page.

Solution: upgrade to Wikka Wiki version 1.3.4-p1 that is available here.