PT-2004-2826 · Tikiwiki · Tikiwiki Cms/Groupware

Published 2004-04-12 · Updated 2017-07-11 · CVE-2004-1928

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Tiki CMS/Groupware (TikiWiki) versions 1.8.1 and earlier

Description The issue concerns the image upload feature, which allows remote attackers to upload and possibly execute arbitrary files. This is achieved via the "img/wiki up" URL.

Recommendations For versions 1.8.1 and earlier, consider disabling the image upload feature until a fix is available. Restrict access to the "img/wiki up" URL to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2004-1928

Affected Products

Tikiwiki Cms/Groupware

References · 8

• 🔥 https://exploit-db.com/exploits/23948 · Exploit
• 🔥 https://exploit-db.com/exploits/43809 · Exploit
• 🔥 http://securityfocus.com/bid/10100 · Exploit
• http://secunia.com/advisories/11344 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-1928 · Security Note
• http://tikiwiki.org/tiki-read_article.php?articleId=66 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15849 · Note
• http://marc.info/?l=bugtraq&m=108180073206947&w=2 · Note