CVE-2004-1924
Tiki CMS/Groupware < 1.8.1 - Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 12 public exploits for CVE-2004-1924. PoCs published by JeiAr.
AI-analyzed exploit summary The provided text describes multiple vulnerabilities in TikiWiki, including XSS via the 'faqId' parameter in 'tiki-view_faq.php'. However, it lacks executable exploit code, making it a vulnerability writeup rather than a functional PoC.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via via the (1) theme parameter to tiki-switch_theme.php, (2) find and priority parameters to messu-mailbox.php, (3) flag, priority, flagval, sort_mode, or find parameters to messu-read.php, (4) articleId parameter to tiki-read_article.php, (5) parentId parameter to tiki-browse_categories.php, (6) comments_threshold parameter to tiki-index.php (7) articleId parameter to tiki-print_article.php, (8) galleryId parameter to tiki-list_file_gallery.php, (9) galleryId parameter to tiki-upload_file.php, (10) faqId parameter to tiki-view_faq.php, (11) chartId parameter to tiki-view_chart.php, or (12) surveyId parameter to tiki-survey_stats_survey.php.
Exploits (12)
The provided text describes multiple vulnerabilities in TikiWiki, including XSS via the 'faqId' parameter in 'tiki-view_faq.php'. However, it lacks executable exploit code, making it a vulnerability writeup rather than a functional PoC.
The provided text describes multiple vulnerabilities in TikiWiki CMS, including XSS via the 'chartId' parameter in 'tiki-view_chart.php'. However, no functional exploit code is present.
The provided text describes multiple vulnerabilities in TikiWiki CMS, including XSS via the 'galleryId' parameter in 'tiki-upload_file.php'. However, no functional exploit code is present.
The provided text describes multiple vulnerabilities in TikiWiki CMS, including XSS via the 'theme' parameter in tiki-switch_theme.php. However, no functional exploit code is present, only a reference to a potential XSS vector.
The provided text describes multiple vulnerabilities in TikiWiki CMS, including XSS via the 'articleId' parameter in 'tiki-read_article.php'. However, it lacks executable exploit code, making it a vulnerability writeup rather than a functional PoC.
The provided text describes multiple vulnerabilities in TikiWiki CMS, including XSS via the 'articleId' parameter in 'tiki-print_article.php'. However, it lacks executable exploit code, making it a vulnerability writeup rather than a functional PoC.
The provided text describes multiple vulnerabilities in TikiWiki CMS, including XSS via the 'galleryId' parameter in 'tiki-list_file_gallery.php'. However, it lacks executable exploit code, making it a vulnerability writeup rather than a functional PoC.
The provided text describes multiple vulnerabilities in TikiWiki, including XSS via the 'page' and 'comments_threshold' parameters in tiki-index.php. No actual exploit code is present, only a reference to a SecurityFocus advisory.
The provided text describes multiple vulnerabilities in TikiWiki CMS, including XSS via the 'parentId' parameter in 'tiki-browse_categories.php'. However, it lacks executable exploit code, making it a vulnerability writeup rather than a functional PoC.
The provided text describes multiple vulnerabilities in an unspecified application, including XSS, SQL injection, and directory traversal. It lists example URLs for XSS exploitation in a 'messu-read.php' script but lacks executable exploit code.
The provided text describes multiple vulnerabilities in an unspecified application, including XSS, SQL injection, and directory traversal. It includes example URLs demonstrating XSS in messu-mailbox.php but lacks executable exploit code.
This is a detailed technical writeup describing multiple vulnerabilities in TikiWiki CMS/Groupware, including path disclosure, XSS, SQL injection, code injection, directory traversal, and arbitrary file upload. It provides specific examples of vulnerable parameters and attack vectors.