Tiki Wiki CMS Groupware Unspecified SQL Injection and Cross Site Scripting Vulnerabilities
BID:63462
Info
Tiki Wiki CMS Groupware Unspecified SQL Injection and Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 63462 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 29 2013 12:00AM |
| Updated: | Oct 29 2013 12:00AM |
| Credit: | Yuji Tounai via JPCERT |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Tiki Wiki CMS Groupware Unspecified SQL Injection and Cross Site Scripting Vulnerabilities
Tiki Wiki CMS Groupware is prone to unspecified SQL-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
The following versions are vulnerable:
Tiki Wiki CMS Groupware prior to 11.1
Tiki Wiki CMS Groupware prior to 10.4
Tiki Wiki CMS Groupware prior to 9.7LTS
Tiki Wiki CMS Groupware prior to 6.13LTS
Tiki Wiki CMS Groupware is prone to unspecified SQL-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
The following versions are vulnerable:
Tiki Wiki CMS Groupware prior to 11.1
Tiki Wiki CMS Groupware prior to 10.4
Tiki Wiki CMS Groupware prior to 9.7LTS
Tiki Wiki CMS Groupware prior to 6.13LTS
Exploit / POC
Tiki Wiki CMS Groupware Unspecified SQL Injection and Cross Site Scripting Vulnerabilities
Attackers can use a browser to exploit these issues. To exploit the cross-site scripting issue, an attacker must entice an unsuspecting user into following a malicious URI.
Attackers can use a browser to exploit these issues. To exploit the cross-site scripting issue, an attacker must entice an unsuspecting user into following a malicious URI.
Solution / Fix
Tiki Wiki CMS Groupware Unspecified SQL Injection and Cross Site Scripting Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Tiki Wiki CMS Groupware Unspecified SQL Injection and Cross Site Scripting Vulnerabilities
References:
References:
- Tiki Wiki CMS Groupware Homepage (Tiki Wiki CMS Groupware)