CVE-2004-1926: tiki tikiwiki_cms\/groupware Code Injection

Vulnerability summary

CVE-2004-1926 is a high (CVSS 7.5) Code Injection vulnerability in tiki tikiwiki_cms\/groupware. EPSS estimates a 7.47% chance of exploitation in the next 30 days, higher than 94.4% of scored vulnerabilities. 4 public exploits are recorded.

Timeline

1. 10-05-2005
   PublishedVulnerability first disclosed.
2. 08-08-2024
   Last modifiedVulnerability information updated.

Description

Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allows remote attackers to inject arbitrary code via the (1) Theme, (2) Country, (3) Real Name, or (4) Displayed time zone fields in a User Profile, or the (5) Name, (6) Description, (7) URL, or (8) Country fields in a Directory/Add Site operation.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.