TikiWiki Multiple Input Validation Vulnerabilities
BID:18421
CVE-2006-3047 | CVE-2006-3048 |Info
TikiWiki Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 18421 |
| Class: | Input Validation Error |
| CVE: |
CVE-2006-3047 CVE-2006-3048 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 14 2006 12:00AM |
| Updated: | Jun 29 2006 05:59PM |
| Credit: | [email protected] is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
TikiWiki Project TikiWiki 1.9.3 1 TikiWiki Project TikiWiki 1.9.3.2 Gentoo Linux |
| Not Vulnerable: |
TikiWiki Project TikiWiki 1.9.4 |
Discussion
TikiWiki Multiple Input Validation Vulnerabilities
TikiWiki is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
TikiWiki is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
Exploit / POC
TikiWiki Multiple Input Validation Vulnerabilities
These issues can be exploited through a web client.
These issues can be exploited through a web client.
Solution / Fix
TikiWiki Multiple Input Validation Vulnerabilities
Solution:
The vendor has released version 1.9.4 to address these issues; please see the reference section for details and vendor advisories.
TikiWiki Project TikiWiki 1.9.3.2
TikiWiki Project TikiWiki 1.9.3 1
Solution:
The vendor has released version 1.9.4 to address these issues; please see the reference section for details and vendor advisories.
TikiWiki Project TikiWiki 1.9.3.2
-
TikiWiki Project tikiwiki-1.9.4.tar.gz
http://prdownloads.sourceforge.net/tikiwiki/tikiwiki-1.9.4.tar.gz
TikiWiki Project TikiWiki 1.9.3 1
-
TikiWiki Project tikiwiki-1.9.4.tar.gz
http://prdownloads.sourceforge.net/tikiwiki/tikiwiki-1.9.4.tar.gz
References
TikiWiki Multiple Input Validation Vulnerabilities
References:
References:
- Sourceforge TikiWiki Site (Thomas Schwartz)
- TikiWiki Sql injection & XSS Vulnerabilities ("[email protected]"