Tikiwiki tiki-special_chars.php XSS Vulnerability

Credit: Mesut Timur
Risk: Low
Local: No
Remote: Yes

CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

H - Security Labs Tikiwiki v1.9.8.3 Security Advisory ID : HSEC#20072212 General Information -------------------------- Name : Tikiwiki Vendor HomePage :http://tikiwiki.org Platforms : PHP && MySQL Vulnerability Type : Input Validation Error Timeline ------------------------- 17 December 2007 -- Vendor Contacted 19 December 2007 -- Vendor Replied 22 December 2007 -- New Release 22 December 2007 -- Advisory Released What is TikiWiki ------------------------ Tikiwiki (Tiki) is your Groupware/CMS (Content Management System) solution. Tiki has the features you need: Wikis (like Mediawiki), Forums (like phpBB) ,Blogs (like WordPress), Articles (like Digg), Image Gallery (like Flickr), Map Server (like Google Maps), Link Directory (like DMOZ), Translation and i18n (like Babel Fish), Free (LGPL) And much more... Vulnerability Overview ------------------------ The script is vulnerable to XSS attacks. Details About Vulnerability ------------------------ XSS Vulnerability (/tikiwiki/tiki-special_chars.php) At the lines between 166-168 : ----------------- ').value=window.opener.document.getElementById('').value+getElementById( 'spec').value;" name="ins" value="ins" /> ">, you can see it.. The attacker can succesfully launch XSS attacks with loading payload on to the URL area_name variable. Solution ----------------------- Download the new release : Tikiwiki 1.9.9 from http://sourceforge.net/project/showfiles.php?group_id=64258&package_id=1 12134&release_id=563456 Credits ----------------------- The vulnerabilities found on 17 December 2007 by Mesut Timur H - Security Labs , http://www.h-labs.org Gebze Institute of Technology Department of Computer Engineering http://www.gyte.edu.tr References ----------------------- Vendor Confirmation : http://tikiwiki.org/ReleaseProcess199 Original Advisory : http://www.h-labs.org/blog/2007/12/24/tikiwiki_1_9_8_3_tiki_special_char s_php_xss_vulnerability.html _________________________________________________________________ Don't get caught with egg on your face. Play Chicktionary! http://club.live.com/chicktionary.aspx?icid=chick_wlhmtextlink1_dec

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2023, cxsecurity.com


Back to Top