TikiWiki CMS Groupware v8.3 - Open Redirect

mediumseverity

5.8CVSS score

13.8%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

tiki-featured_link.php in TikiWiki CMS/Groupware 8.3 allows remote attackers to load arbitrary web site pages into frames and conduct phishing attacks via the url parameter, aka "frame injection

Impact

Successful exploitation of this vulnerability could lead to phishing attacks and potential unauthorized access to sensitive information.

Fix

Apply the latest security patches or upgrade to a newer version of TikiWiki CMS Groupware to mitigate the risk of open redirect vulnerabilities.

How to confirm it

Send: GET {{BaseURL}}/tiki-featured_link.php?type=f&url=https://interact.sh
Positive when: matches in header /(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]…/

Run it with nuclei: nuclei -id CVE-2012-5321 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2012-5321

info:
  name: TikiWiki CMS Groupware v8.3 - Open Redirect
  author: ctflearner
  severity: medium
  description: |
    tiki-featured_link.php in TikiWiki CMS/Groupware 8.3 allows remote attackers to load arbitrary web site pages into frames and conduct phishing attacks via the url parameter, aka "frame injection
  impact: |
    Successful exploitation of this vulnerability could lead to phishing attacks and potential unauthorized access to sensitive information.
  remediation: |
    Apply the latest security patches or upgrade to a newer version of TikiWiki CMS Groupware to mitigate the risk of open redirect vulnerabilities.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2012-5321
    - https://www.exploit-db.com/exploits/36848
    - http://st2tea.blogspot.com/2012/02/tiki-wiki-cms-groupware-frame-injection.html
    - https://exchange.xforce.ibmcloud.com/vulnerabilities/73403
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:N
    cvss-score: 5.8
    cve-id: CVE-2012-5321
    cwe-id: CWE-20
    epss-score: 0.1375
    epss-percentile: 0.96539
    cpe: cpe:2.3:a:tiki:tikiwiki_cms\/groupware:8.3:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: tiki
    product: tikiwiki_cms\/groupware
    shodan-query: http.html:"tiki wiki"
    fofa-query: body="tiki wiki"
  tags: cve,cve2012,redirect,tikiwiki,groupware,tiki,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/tiki-featured_link.php?type=f&url=https://interact.sh"

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$'

References

Use this check only on systems you are authorised to test. Where the data comes from