Tikiwiki 1.9.8.3 tiki-special_chars.php XSS Vulnerability

[Mesut Timur]

H - Security Labs =20
Tikiwiki v1.9.8.3 Security Advisory
ID : HSEC#20072212 =20

General Information
--------------------------
Name : Tikiwiki 1.9.8.3
Vendor HomePage :http://tikiwiki.org
Platforms : PHP && MySQL
Vulnerability Type : Input Validation Error

Timeline
-------------------------
17 December 2007 -- Vendor Contacted=20
19 December 2007 -- Vendor Replied
22 December 2007 -- New Release
22 December 2007 -- Advisory Released

What is TikiWiki
------------------------
Tikiwiki (Tiki) is your Groupware/CMS (Content Management System) solution.=
Tiki has the features you need:
Wikis (like Mediawiki), Forums (like phpBB) ,Blogs (like WordPress), Articl=
es (like Digg), Image Gallery (like Flickr), Map Server (like Google Maps),=
Link Directory (like DMOZ), Translation and i18n (like Babel Fish), Free (=
LGPL) And much more...

Vulnerability Overview
------------------------
The script is vulnerable to XSS attacks.

Details About Vulnerability
------------------------
XSS Vulnerability (/tikiwiki/tiki-special_chars.php)
At the lines between 166-168 :
-----------------
').value=3Dwindow.opener.document.getElementById(' ').value+getElementById=
('spec').value;"
name=3D"ins" value=3D"ins" />
">, you can see it..
The attacker can succesfully launch XSS attacks with loading payload on to =
the URL area_name variable.

Solution
-----------------------
Download the new release : Tikiwiki 1.9.9
from http://sourceforge.net/project/showfiles.php?group_id=3D64258&package_=
id=3D112134&release_id=3D563456

Credits
-----------------------
The vulnerabilities found on 17 December 2007
by Mesut Timur=20
H - Security Labs , http://www.h-labs.org
Gebze Institute of Technology
Department of Computer Engineering
http://www.gyte.edu.tr

References
-----------------------
Vendor Confirmation : http://tikiwiki.org/ReleaseProcess199
Original Advisory : http://www.h-labs.org/blog/2007/12/24/tikiwiki_1_9_8_3_=
tiki_special_chars_php_xss_vulnerability.html
__________________________________________________ _______________
Don't get caught with egg on your face. Play Chicktionary!
http://club.live.com/chicktionary.aspx?icid=3Dchick_wlhmtextlink1_dec=