PT-2004-2824 · Tikiwiki · Tikiwiki Cms/Groupware

Jeiar · Published 2004-04-11 · Updated 2016-10-18 · CVE-2004-1926

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Tiki CMS/Groupware (TikiWiki) versions 1.8.1 and earlier

Description The issue allows remote attackers to inject arbitrary code via specific fields in a User Profile or Directory/Add Site operation. The vulnerable fields include Theme, Country, Real Name, and Displayed time zone in a User Profile, as well as Name, Description, URL, and Country in a Directory/Add Site operation.

Recommendations For versions 1.8.1 and earlier, consider restricting access to the User Profile and Directory/Add Site features until a fix is available. As a temporary workaround, avoid using the vulnerable fields Theme, Country, Real Name, Displayed time zone, Name, Description, URL, in these operations to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2004-1926

Affected Products

Tikiwiki Cms/Groupware

References · 8

• 🔥 https://exploit-db.com/exploits/43809 · Exploit
• 🔥 http://securityfocus.com/bid/10100 · Exploit
• 🔥 https://exploit-db.com/exploits/23950 · Exploit
• 🔥 https://exploit-db.com/exploits/23951 · Exploit
• http://tikiwiki.org/tiki-read_article.php?articleId=66 · Patch
• http://secunia.com/advisories/11344 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-1926 · Security Note
• http://marc.info/?l=bugtraq&m=108180073206947&w=2 · Note