Summary
TikiWiki is prone to multiple unspecified vulnerabilities, including:
- An unspecified SQL-injection vulnerability
- An unspecified authentication-bypass vulnerability - An unspecified vulnerability
Exploiting these issues could allow an attacker to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, and gain unauthorized access to the affected application. Other attacks are also possible.
Versions prior to TikiWiki 4.2 are vulnerable.
Solution
The vendor has released an advisory and fixes. Please see the references for details.
References
- http://info.tikiwiki.org/article86-Tiki-Announces-3-5-and-4-2-Releases
- http://info.tikiwiki.org/tiki-index.php?page=homepage
- http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki?view=rev&revision=24734
- http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki?view=rev&revision=25046
- http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki?view=rev&revision=25424
- http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki?view=rev&revision=25435
- http://www.securityfocus.com/bid/38608
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2010-1133, CVE-2010-1134, CVE-2010-1135, CVE-2010-1136 -
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities
- 3Com OfficeConnect VPN Firewall Default Password Security Bypass Vulnerability
- Apache Solr XML External Entity(XXE) Vulnerability-02 Jan-14
- Ajax File and Image Manager 'data.php' PHP Code Injection Vulnerability
- Artifectx xClassified 'catid' SQL Injection Vulnerability
- Avenger's News System Command Execution