high7.5Public exploit code
CVE-2004-1926
Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to inject arbitrary code via the (1) Theme, (2) Country, (3) Real Name, or (4) Displaye…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- TikiWiki Project 1.8 - Add Site Multiple Options Remote Code Injections2004-04-12 · webapps · php · Verified
- TikiWiki Project 1.8 - User Profile Multiple Option Remote Code Injections2004-04-12 · webapps · php · Verified
- TikiWiki < 1.8.1 - Multiple Vulnerabilities2004-04-11 · webapps · php
Impact
Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to inject arbitrary code via the (1) Theme, (2) Country, (3) Real Name, or (4) Displayed time zone fields in a User Profile, or the (5) Name, (6) Description, (7) URL, or (8) Country fields in a Directory/Add Site operation.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tiki | Tikiwiki Cms\/Groupware | through 1.8.1 Version 1.6.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://marc.info/?l=bugtraq&m=108180073206947&w=2
- http://secunia.com/advisories/11344
- http://tikiwiki.org/tiki-read_article.php?articleId=66
- http://www.securityfocus.com/bid/10100
- http://marc.info/?l=bugtraq&m=108180073206947&w=2
- http://secunia.com/advisories/11344
- http://tikiwiki.org/tiki-read_article.php?articleId=66
- http://www.securityfocus.com/bid/10100