CVE-2004-1926
TikiWiki CMS/Groupware < 1.8.1 - Remote Code Execution via User Profile or Directory Fields
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2004-1926. PoCs published by JeiAr.
AI-analyzed exploit summary This is a vulnerability writeup describing multiple issues in an unspecified application, including path disclosure, XSS, SQL injection, and file upload vulnerabilities. No actual exploit code is provided.
Description
Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to inject arbitrary code via the (1) Theme, (2) Country, (3) Real Name, or (4) Displayed time zone fields in a User Profile, or the (5) Name, (6) Description, (7) URL, or (8) Country fields in a Directory/Add Site operation.
Exploits (3)
This is a vulnerability writeup describing multiple issues in an unspecified application, including path disclosure, XSS, SQL injection, and file upload vulnerabilities. No actual exploit code is provided.
The provided text is a vulnerability description for CVE-2004-1926, detailing multiple issues such as path disclosure, XSS, SQL injection, and directory traversal in an unspecified application. It lacks executable exploit code or technical proof-of-concept details.
This is a detailed technical writeup describing multiple vulnerabilities in TikiWiki CMS/Groupware, including path disclosure, XSS, SQL injection, code injection, directory traversal, and arbitrary file upload. It provides specific examples of vulnerable parameters and attack vectors.