2 ms·

As a MediaWiki dev, i would love to know what happened here. Was it a vulnerability in MediaWiki? Some custom extension? Some other component on the wiki server

As a MediaWiki dev, i would love to know what happened here. Was it a vulnerability in MediaWiki? Some custom extension? Some other component on the wiki server unrelated to mediawiki? Was it just a really old software version with known public CVEs, ir something else? Edit: the "disable indexing" makes it sound like there was some sort of system to upload private stuff and the directory it went in had mod_index enabled. Which i guess would not have much to do with MediaWiki.

vanderaj 3y ago
Directory browsing was enabled and files were uploaded to an exposed directory during a much earlier time. The only issue was that the directory was in the middle of the MediaWiki webroot. Sadly, the institutional knowledge that these were there was lost in the mists of time. I would never have expected non-MediaWiki files to be in the webroot.