PT-2004-2826 · Tikiwiki · Tikiwiki Cms/Groupware

Publicado 2004-04-12 · Atualizado 2017-07-11 · CVE-2004-1928

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Tiki CMS/Groupware (TikiWiki) versions 1.8.1 and earlier

Description The issue concerns the image upload feature, which allows remote attackers to upload and possibly execute arbitrary files. This is achieved via the "img/wiki up" URL.

Recommendations For versions 1.8.1 and earlier, consider disabling the image upload feature until a fix is available. Restrict access to the "img/wiki up" URL to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2004-1928

Produtos afetados

Tikiwiki Cms/Groupware

Referências · 8

• 🔥 https://exploit-db.com/exploits/23948 · Exploit
• 🔥 https://exploit-db.com/exploits/43809 · Exploit
• 🔥 http://securityfocus.com/bid/10100 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15849 · Nota
• http://secunia.com/advisories/11344 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=108180073206947&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-1928 · Nota de Segurança
• http://tikiwiki.org/tiki-read_article.php?articleId=66 · Aviso do Fabricante