CVE-2004-1927
TikiWiki CMS/Groupware < 1.8.1 - Path Traversal via Mapfile Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2004-1927. PoCs published by JeiAr.
AI-analyzed exploit summary The provided text describes a directory traversal vulnerability in TikiWiki's tiki-map.phtml module, allowing path disclosure via a crafted request. No executable exploit code is present, only a reference to the vulnerability.
Description
Directory traversal vulnerability in the map feature (tiki-map.phtml) in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to determine the existence of arbitrary files via .. (dot dot) sequences in the mapfile parameter.
Exploits (2)
The provided text describes a directory traversal vulnerability in TikiWiki's tiki-map.phtml module, allowing path disclosure via a crafted request. No executable exploit code is present, only a reference to the vulnerability.
This is a detailed technical writeup describing multiple vulnerabilities in TikiWiki CMS, including path disclosure, XSS, SQL injection, code injection, directory traversal, and arbitrary file upload. It provides specific examples of vulnerable parameters and attack vectors but does not include functional exploit code.