CVE Feed

    Dashboard / CVE / CVE-2012-0911

    CVE-2012-0911

    TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieName to lib/banners/bannerlib.php; (2) printpages or (3) printstructures parameter to (a) tiki-print_multi_pages.php or (b) tiki-print_pages.php; or (4) sendpages, (5) sendstructures, or (6) sendarticles parameter to tiki-send_objects.php, which is not properly handled when processed by the unserialize function.

    Published:Jul 12, 2012
    Last Modified:Apr 11, 2025
    EPS:Jul 12, 2012
    EPSS Score:0.77945
    CVSS Score:9.8

    Affected Products

    Vendor
    Tiki
    Product
    Tikiwiki Cms\/groupware

    Exploits

    http://archives.neohapsis.com/archives/bugtraq/2012-07/0020.htmlhttp://www.exploit-db.com/exploits/19573http://www.exploit-db.com/exploits/19630http://archives.neohapsis.com/archives/bugtraq/2012-07/0020.htmlhttp://www.exploit-db.com/exploits/19573http://www.exploit-db.com/exploits/19630https://www.exploit-db.com/exploits/19573https://www.exploit-db.com/exploits/19630

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-586 Object Injection

    References

    http://archives.neohapsis.com/archives/bugtraq/2012-07/0020.html
    http://dev.tiki.org/item4109
    http://info.tiki.org/article190-Tiki-Wiki-CMS-Groupware-Updates-Tiki-6-7-LTS
    http://info.tiki.org/article191-Tiki-Releases-8-4
    http://osvdb.org/83534
    http://www.exploit-db.com/exploits/19573
    http://www.exploit-db.com/exploits/19630
    http://www.securityfocus.com/bid/54298
    https://exchange.xforce.ibmcloud.com/vulnerabilities/76758
    http://archives.neohapsis.com/archives/bugtraq/2012-07/0020.html
    http://dev.tiki.org/item4109
    http://info.tiki.org/article190-Tiki-Wiki-CMS-Groupware-Updates-Tiki-6-7-LTS
    http://info.tiki.org/article191-Tiki-Releases-8-4
    http://osvdb.org/83534
    http://www.exploit-db.com/exploits/19573
    http://www.exploit-db.com/exploits/19630
    http://www.securityfocus.com/bid/54298
    https://exchange.xforce.ibmcloud.com/vulnerabilities/76758

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High