bugtraq - CVE-2016-10143: Vulnerability to read arbitrary files in "Tiki Wiki"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201703100926.v2A9QGk1032299@sf01web3.securityfocus.com>
Date: Fri, 10 Mar 2017 09:26:16 GMT
From: Leon.Zhao.7@...il.com
To: bugtraq@...urityfocus.com
Subject: CVE-2016-10143: Vulnerability to read arbitrary files in "Tiki Wiki"

Credits
===============
Zhao Liang, Huawei Weiran Labs

Vendor:
===============
Tiki

Product:
========================
Tiki Wiki CMS

The Tiki Wiki CMS Groupware project (aka TikiWiki or Tiki) is an open source initiative that releases and maintains a powerful OpenSource Content Management System (CMS) and Groupware called Tiki.

Vulnerability Type:
================================
Access Validation Error

CVE Reference:
==============
CVE-2016-10143

Vulnerability Details:
=====================
This vulnerability allows remote users to read arbitrary files on a targeted system via a crafted pathname in the banner URL field of Tiki Wiki.

Exploitation Technique:
=======================
Remote

Severity Level:
===============
High

Best Regards,
Zhao Liang, Huawei Weiran Labs