CVE-2004-1923
Tiki CMS/Groupware < 1.8.1 - Exposure of Sensitive Information via Direct Request to Multiple Scripts
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2004-1923. PoCs published by JeiAr, GulfTech Security.
AI-analyzed exploit summary The provided text describes multiple vulnerabilities in various modules of an application, including path disclosure, XSS, SQL injection, directory traversal, and arbitrary file upload. It references specific parameters in 'tiki-browse_categories.php' but lacks executable exploit code.
Description
Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to gain sensitive information via a direct request to (1) banner_click.php, (2) categorize.php, (3) tiki-admin_include_directory.php, (4) tiki-directory_search.php, which reveal the web server path in an error message.
Exploits (2)
The provided text describes multiple vulnerabilities in various modules of an application, including path disclosure, XSS, SQL injection, directory traversal, and arbitrary file upload. It references specific parameters in 'tiki-browse_categories.php' but lacks executable exploit code.
This is a detailed technical writeup describing multiple vulnerabilities in TikiWiki CMS/Groupware, including path disclosure, XSS, SQL injection, code injection, directory traversal, and arbitrary file upload. It provides specific examples of vulnerable parameters and attack vectors but does not include functional exploit code.