CVE-2010-0288 in DokuWiki
Summary
by MITRE
A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to gain privileges and access closed wikis by editing current ACL statements, as demonstrated in the wild in January 2010.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/30/2026
The vulnerability identified as CVE-2010-0288 represents a critical access control flaw in the DokuWiki content management system that existed in versions prior to 2009-12-25b. This issue stems from a fundamental programming error within the ACL Manager plugin's administrative permission verification mechanism, specifically located in the plugins/acl/ajax.php file. The flaw manifests as a typographical error that undermines the intended security controls designed to protect closed wikis from unauthorized access. The vulnerability's significance lies in its ability to allow remote attackers to escalate their privileges and gain administrative access to wikis that should be restricted to authorized users only.
The technical implementation of this vulnerability involves a malformed permission check that fails to properly validate administrator credentials when processing Access Control List modifications. When attackers exploit this flaw, they can manipulate the ACL statements directly through the ajax interface, effectively bypassing the normal authentication and authorization processes that should prevent unauthorized users from modifying wiki security settings. This type of vulnerability falls under the CWE-284 category of Improper Access Control, specifically targeting the weakness where insufficient checks are performed to verify that a user has the necessary privileges before allowing administrative actions. The flaw operates at the application level and demonstrates a classic case of inadequate input validation and privilege escalation.
The operational impact of this vulnerability extends beyond simple unauthorized access, as it provides attackers with the capability to modify wiki permissions and potentially gain full administrative control over closed wikis. This allows malicious actors to not only view restricted content but also to alter the security policies that govern access to the wiki, creating a persistent backdoor for future attacks. The vulnerability was actively exploited in the wild during January 2010, indicating that it was not merely a theoretical flaw but a real threat that organizations faced. The exploitation process requires minimal technical expertise, making it particularly dangerous as it could be leveraged by attackers with varying skill levels. This vulnerability directly aligns with ATT&CK technique T1078.004 which covers Valid Accounts and T1484.001 which addresses Domain Policy Modification, as it enables attackers to establish persistent access and modify security policies.
Organizations using affected versions of DokuWiki should immediately implement mitigations including updating to the patched version released in December 2009, which corrected the administrative permission check logic. Network-level protections such as firewalls and intrusion detection systems can help monitor for exploitation attempts, while application-level controls should focus on restricting access to the acl/ajax.php endpoint until the patch is applied. The vulnerability demonstrates the critical importance of proper access control implementation and the potential consequences of seemingly minor programming errors in security-critical components. Regular security audits and code reviews should emphasize permission validation logic, particularly in modules handling user authentication and authorization. The incident underscores the necessity of maintaining up-to-date software and the potential for privilege escalation vulnerabilities to serve as initial access vectors for more extensive attacks. Organizations should also implement monitoring for unauthorized ACL modifications and establish incident response procedures for handling potential exploitation attempts.