CVE-2018-7304
Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE or Calculator window on the victim machine to perform malicious activity, as demonstrated by an "=cmd|' /C calc'!A0" payload during User Creation.
Published
2018-02-21T20:29:00.427
Last Modified
2024-11-21T04:11:58.473
Status
Modified
Source
[email protected]
Severity
CVSSv3.0: 8.8 (HIGH)
CVSSv2 Vector
AV:N/AC:L/Au:S/C:P/I:P/A:P
- Access Vector: NETWORK
- Access Complexity: LOW
- Authentication: SINGLE
- Confidentiality Impact: PARTIAL
- Integrity Impact: PARTIAL
- Availability Impact: PARTIAL
Exploitability Score
8.0
Impact Score
6.4
Weaknesses
Affected Vendors & Products
| Type |
Vendor |
Product |
Version/Range |
Vulnerable? |
| Application |
tiki
|
tiki
|
17.1 |
Yes
|
References