Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
TikiWiki 21.2 allows templates to be edited without CSRF protection. This could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected system. An attacker could exploit this vulnerability by persuading a user of the interface to follow a maliciously crafted link. A successful exploit could allow the attacker to perform arbitrary actions on an affected system with the privileges of the user. These action include allowing attackers to submit their own code through an authenticated user resulting in local file Inclusion. If an authenticated user who is able to edit TikiWiki templates visits an malicious website, template code can be edited.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Tiki Wiki 跨站请求伪造漏洞
Vulnerability Description
Tiki Wiki是Tiki社区的一款基于Php的Wiki系统。 Tiki Wiki 21.2存在安全漏洞，该漏洞允许在没有CSRF保护的情况下编辑模板。这可能允许未经身份验证的远程攻击者可利用该漏洞执行跨站点请求伪造(CSRF)攻击，并在受影响的系统上执行任意操作。该漏洞是由于受影响系统的基于web的管理界面的CSRF保护不足。攻击者可利用该漏洞可以通过说服界面的用户遵循恶意设计的链接来利用这个漏洞。成功的利用可以允许攻击者可利用该漏洞利用用户的特权在受影响的系统上执行任意操作。
CVSS Information
N/A
Vulnerability Type
N/A