Tikiwiki 1.9.8.3 tiki-special_chars.php XSS Vulnerability
H - Security Labs
Tikiwiki v1.9.8.3 Security Advisory
ID : HSEC#20072212
General Information
--------------------------
Name : Tikiwiki 1.9.8.3
Vendor HomePage :http://tikiwiki.org
Platforms : PHP && MySQL
Vulnerability Type : Input Validation Error
Timeline
-------------------------
17 December 2007 -- Vendor Contacted
19 December 2007 -- Vendor Replied
22 December 2007 -- New Release
22 December 2007 -- Advisory Released
What is TikiWiki
------------------------
Tikiwiki (Tiki) is your Groupware/CMS (Content Management System) solution. Tiki has the features you need:
Wikis (like Mediawiki), Forums (like phpBB) ,Blogs (like WordPress), Articles (like Digg), Image Gallery (like Flickr), Map Server (like Google Maps), Link Directory (like DMOZ), Translation and i18n (like Babel Fish), Free (LGPL) And much more...
Vulnerability Overview
------------------------
The script is vulnerable to XSS attacks.
Details About Vulnerability
------------------------
XSS Vulnerability (/tikiwiki/tiki-special_chars.php)
At the lines between 166-168 :
-----------------
<input type="button" class="button"
onclick="javascript:window.opener.document.getElementById('<?php
print($_REQUEST["area_name"]);?>').value=window.opener.document.getElementById('<?php print($_REQUEST["area_name"]);?>').value+getElementById('spec').value;"
name="ins" value="ins" />
<input type="button" class="button"
-----------------
You see that, there are two printing of "area_name" variable without properly sanitization.This causes reflected XSS vulnerability and If you set area_name variable to :
>"><script>alert(1)</script>, you can see it..
The attacker can succesfully launch XSS attacks with loading payload on to the URL area_name variable.
Solution
-----------------------
Download the new release : Tikiwiki 1.9.9
from http://sourceforge.net/project/showfiles.php?group_id=64258&package_id=112134&release_id=563456
Credits
-----------------------
The vulnerabilities found on 17 December 2007
by Mesut Timur <mesut@h-labs.org>
H - Security Labs , http://www.h-labs.org
Gebze Institue of Technology,Computer Engineering,http://www.gyte.edu.tr
References
-----------------------
Vendor Confirmation : http://tikiwiki.org/ReleaseProcess199