TikiWiki Sql injection & XSS Vulnerabilities

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1053202 漏洞类型
发布时间 2006-06-18 更新时间 2006-06-18
CVE编号 CVE-2006-3048
CVE-2006-3047
CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2006060107
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
----------------------------------------------------------------
[#] Security Advisory
[^] http://securitynews.ir/

[>] Advisory Title: TikiWiki Sql injection & XSS Vulnerabilities
[@] Author : bug [@] securitynews.ir
[$] Product Vendor : http://tikiwiki.org/
[.] Affected Versions : 1.9.3.2 (and maybe before)
[/] Release Date : 06/13/2006
----------------------------------------------------------------
[*] Overview :
Tikiwiki is a very powerful multilingual Wiki/CMS/Groupware, but
it has some security bugs too .
One sql injection and several cross-site scripting bugs have
been found in tikiwiki 1.9.3.2 (and tested in 1.9.3.1) .

[*] Details :
No exploitable detail is going to be released .

[*] Solution :
Vendor contacted on 06/09/2006 and they have been released a new
version (tikiwiki 1.9.4) :
http://sourceforge.net/project/showfiles.php?group_id=64258

------------------------------
http://securitynews.ir/