PT-2004-2824 · Tikiwiki · Tikiwiki Cms/Groupware

Jeiar · Publicado 2004-04-11 · Atualizado 2016-10-18 · CVE-2004-1926

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Tiki CMS/Groupware (TikiWiki) versions 1.8.1 and earlier

Description The issue allows remote attackers to inject arbitrary code via specific fields in a User Profile or Directory/Add Site operation. The vulnerable fields include Theme, Country, Real Name, and Displayed time zone in a User Profile, as well as Name, Description, URL, and Country in a Directory/Add Site operation.

Recommendations For versions 1.8.1 and earlier, consider restricting access to the User Profile and Directory/Add Site features until a fix is available. As a temporary workaround, avoid using the vulnerable fields Theme, Country, Real Name, Displayed time zone, Name, Description, URL, in these operations to minimize the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2004-1926

Produtos afetados

Tikiwiki Cms/Groupware

Referências · 8

• 🔥 https://exploit-db.com/exploits/43809 · Exploit
• 🔥 http://securityfocus.com/bid/10100 · Exploit
• 🔥 https://exploit-db.com/exploits/23950 · Exploit
• 🔥 https://exploit-db.com/exploits/23951 · Exploit
• http://tikiwiki.org/tiki-read_article.php?articleId=66 · Correção
• http://secunia.com/advisories/11344 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-1926 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=108180073206947&w=2 · Nota