CVE-2006-2635: XSS
Multiple cross-site scripting (XSS) vulnerabilities in Tikiwiki (aka Tiki CMS/Groupware) 1.9.x allow remote attackers to inject arbitrary web script or HTML via malformed nested HTML tags such as "<scr<script>ipt>" in (1) offset and (2) days parameters in (a) tiki-lastchanges.php, the (3) find and (4) offset parameters in (b) tiki-orphanpages.php, the (5) offset and (6) initial parameters in (c) tiki-listpages.php, and (7) an unspecified field in (d) tiki-remindpassword.php; and allow remote authenticated users with admin privileges to inject arbitrary web script or HTML via (8) an unspecified field in a metatags action in (e) tiki-admin.php, the (9) offset parameter in (f) tiki-adminrssmodules.php, the (10) offset and (11) max parameters in (g) tiki-syslog.php, the (12) numrows parameter in (h) tiki-adminusers.php, (13) an unspecified field in (i) tiki-adminusers.php, (14) an unspecified field in (j) tiki-adminhotwords.php, unspecified fields in (15) "Assign new module" and (16) "Create new user module" in (k) tiki-adminmodules.php, (17) an unspecified field in "Add notification" in (l) tiki-adminnotifications.php, (18) the offset parameter in (m) tiki-adminnotifications.php, the (19) Name and (20) Dsn fields in (o) tiki-admindsn.php, the (21) offset parameter in (p) tiki-admincontenttemplates.php, (22) an unspecified field in "Create new template" in (q) tiki-admincontenttemplates.php, and the (23) offset parameter in (r) tiki-adminchat.php.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-2635?
The severity of CVE-2006-2635 is classified as medium, but it can lead to significant issues such as session hijacking and data theft due to XSS attacks.
How do I fix CVE-2006-2635?
To fix CVE-2006-2635, you should upgrade Tikiwiki to a patched version beyond 1.9.10 where the vulnerabilities are resolved.
What applications are affected by CVE-2006-2635?
CVE-2006-2635 affects multiple versions of Tikiwiki, specifically versions 1.9.0 through 1.9.11.
What type of vulnerabilities are found in CVE-2006-2635?
CVE-2006-2635 comprises multiple cross-site scripting (XSS) vulnerabilities.
Can CVE-2006-2635 be exploited remotely?
Yes, CVE-2006-2635 can be exploited remotely by attackers to inject arbitrary web scripts or HTML.