Exploitation Summary
EIP tracks 2 public exploits for CVE-2025-34113.
PoCs published by Dany Ouellet, h00die <[email protected]>, Dany Ouellet, including Metasploit module exploits/linux/http/tiki_calendar_exec.
AI-analyzed exploit summary This exploit demonstrates a remote code execution (RCE) vulnerability in Tiki-Wiki CMS via the 'viewmode' parameter in tiki-calendar.php. The vulnerability allows arbitrary PHP code execution due to improper input sanitization.
Description
An authenticated command injection vulnerability exists in Tiki Wiki CMS versions ≤14.1, ≤12.4 LTS, ≤9.10 LTS, and ≤6.14 via the `viewmode` GET parameter in `tiki-calendar.php`. When the calendar module is enabled and an authenticated user has permission to access it, an attacker can inject and execute arbitrary PHP code. Successful exploitation leads to remote code execution in the context of the web server user.
Exploits (2)
This exploit demonstrates a remote code execution (RCE) vulnerability in Tiki-Wiki CMS via the 'viewmode' parameter in tiki-calendar.php. The vulnerability allows arbitrary PHP code execution due to improper input sanitization.
This Metasploit module exploits a remote code execution vulnerability in Tiki-Wiki CMS's calendar module via the viewmode GET parameter. It authenticates with provided credentials, sends a malicious payload, and achieves RCE on vulnerable versions.
References (5)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N