TikiWiki 'tiki-edit_article.php' Cross-Site Scripting Vulnerability
BID:27968
Info
TikiWiki 'tiki-edit_article.php' Cross-Site Scripting Vulnerability
| Bugtraq ID: | 27968 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-1047 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 23 2008 12:00AM |
| Updated: | May 07 2015 05:32PM |
| Credit: | Fortify Software discovered this vulnerability. |
| Vulnerable: |
TikiWiki Project TikiWiki 1.9.10 TikiWiki Project TikiWiki 1.9.9 TikiWiki Project TikiWiki 1.9.8 1 TikiWiki Project TikiWiki 1.9.8 TikiWiki Project TikiWiki 1.9.7 TikiWiki Project TikiWiki 1.9.6 TikiWiki Project TikiWiki 1.9.5 TikiWiki Project TikiWiki 1.9.4 TikiWiki Project TikiWiki 1.9.3 1 TikiWiki Project TikiWiki 1.9.2 TikiWiki Project TikiWiki 1.9.1 .1 TikiWiki Project TikiWiki 1.9.1 TikiWiki Project TikiWiki 1.9 -rc3.1 TikiWiki Project TikiWiki 1.9 -rc3 TikiWiki Project TikiWiki 1.9 -rc2 TikiWiki Project TikiWiki 1.9 -rc1 TikiWiki Project TikiWiki 1.9.8.3 TikiWiki Project TikiWiki 1.9.8.2 TikiWiki Project TikiWiki 1.9.3.2 |
| Not Vulnerable: |
TikiWiki Project TikiWiki 1.9.10.1 |
Discussion
TikiWiki 'tiki-edit_article.php' Cross-Site Scripting Vulnerability
TikiWiki is prone a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
The issue affects versions prior to TikiWiki 1.9.10.1.
TikiWiki is prone a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
The issue affects versions prior to TikiWiki 1.9.10.1.
Exploit / POC
TikiWiki 'tiki-edit_article.php' Cross-Site Scripting Vulnerability
To exploit this issue, an attacker must entice an unsuspecting user to follow a malicious URI.
To exploit this issue, an attacker must entice an unsuspecting user to follow a malicious URI.
Solution / Fix
TikiWiki 'tiki-edit_article.php' Cross-Site Scripting Vulnerability
Solution:
The vendor released updates to address this issue. Please see the references for more information.
TikiWiki Project TikiWiki 1.9.8.3
Solution:
The vendor released updates to address this issue. Please see the references for more information.
TikiWiki Project TikiWiki 1.9.8.3
-
TikiWiki Project tikiwiki-1.9.9.tar.gz
http://downloads.sourceforge.net/tikiwiki/tikiwiki-1.9.9.tar.gz?modtim e=1198314005&big_mirror=1
References
TikiWiki 'tiki-edit_article.php' Cross-Site Scripting Vulnerability
References:
References:
- TikiWiki 1.9.10 Release Notes (TikiWiki Project)
- TikiWiki Homepage (TikiWiki Project)
- Wish list - Tracker item #1498 (TikiWiki Project)