CVE-2004-1925 - 漏洞详情

CVE-2004-1925 (CNNVD-200404-017)

HIGH 有利用代码

中文标题:

TikiWiki项目多个输入验证漏洞

英文标题:

Multiple SQL injection vulnerabilities in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allow remo...

CVSS分数: 7.5

发布时间: 2005-05-10 04:00:00

漏洞类型: SQL注入

状态: PUBLISHED

数据质量分数: 0.40

数据版本: v19

漏洞描述

中文描述:

Tiki CMS/Groupware (TikiWiki) 1.8.1及其早期版本存在多个SQL注入漏洞。远程攻击者可以通过(1) tiki-usermenu.php， (2) tiki-list_file_gallery.php， (3) tiki-directory_ranking.php， (4) tiki-browse_categories.php， (5) tiki-index.php， (6) tiki-user_tasks.php， (7) tiki-directory_ranking.php， (8) tiki-directory_search.php， (9) tiki-file_galleries.php， (10) tiki-list_faqs.php， (11) tiki-list_trackers.php， (12) tiki-list_blogs.php， or via the offset parameter in (13) tiki-usermenu.php， (14) tiki-browse_categories.php， (15) tiki-index.php， (16) tiki-user_tasks.php， (17) tiki-list_faqs.php， (18) tiki-list_trackers.php， or (19) tiki-list_blogs.phpthe中的sort_mode参数执行任意的SQL命令。

英文描述:

Multiple SQL injection vulnerabilities in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allow remote attackers to execute arbitrary SQL commands via the sort_mode parameter in (1) tiki-usermenu.php, (2) tiki-list_file_gallery.php, (3) tiki-directory_ranking.php, (4) tiki-browse_categories.php, (5) tiki-index.php, (6) tiki-user_tasks.php, (7) tiki-directory_ranking.php, (8) tiki-directory_search.php, (9) tiki-file_galleries.php, (10) tiki-list_faqs.php, (11) tiki-list_trackers.php, (12) tiki-list_blogs.php, or via the offset parameter in (13) tiki-usermenu.php, (14) tiki-browse_categories.php, (15) tiki-index.php, (16) tiki-user_tasks.php, (17) tiki-list_faqs.php, (18) tiki-list_trackers.php, or (19) tiki-list_blogs.php.

CWE类型:

CWE-89

受影响产品

厂商	产品	版本	版本范围	平台	CPE
tiki	tikiwiki_cms\/groupware	*	-	-	`cpe:2.3:a:tiki:tikiwiki_cms\/groupware::::::::`
tiki	tikiwiki_cms\/groupware	1.6.1	-	-	`cpe:2.3:a:tiki:tikiwiki_cms\/groupware:1.6.1:::::::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

10100 vdb-entry
cve.org

访问

20040411 Multiple Vulnerabilities In Tiki CMS/Groupware [ TikiWiki ] mailing-list
cve.org

访问

11344 third-party-advisory
cve.org

访问

无标题 x_refsource_CONFIRM
cve.org

访问

tikiwiki-sql-injection(15845) vdb-entry
cve.org

访问

ExploitDB EDB-23963 EXPLOIT
exploitdb

访问

Download Exploit EDB-23963 EXPLOIT
exploitdb

访问

CVE Reference: CVE-2004-1925 ADVISORY
cve.org

访问

ExploitDB EDB-23964 EXPLOIT
exploitdb

访问

Download Exploit EDB-23964 EXPLOIT
exploitdb

访问

ExploitDB EDB-23965 EXPLOIT
exploitdb

访问

Download Exploit EDB-23965 EXPLOIT
exploitdb

访问

ExploitDB EDB-23966 EXPLOIT
exploitdb

访问

Download Exploit EDB-23966 EXPLOIT
exploitdb

访问

ExploitDB EDB-23971 EXPLOIT
exploitdb

访问

Download Exploit EDB-23971 EXPLOIT
exploitdb

访问

ExploitDB EDB-23972 EXPLOIT
exploitdb

访问

Download Exploit EDB-23972 EXPLOIT
exploitdb

访问

ExploitDB EDB-23973 EXPLOIT
exploitdb

访问

Download Exploit EDB-23973 EXPLOIT
exploitdb

访问

ExploitDB EDB-23974 EXPLOIT
exploitdb

访问

Download Exploit EDB-23974 EXPLOIT
exploitdb

访问

ExploitDB EDB-23975 EXPLOIT
exploitdb

访问

Download Exploit EDB-23975 EXPLOIT
exploitdb

访问

ExploitDB EDB-23976 EXPLOIT
exploitdb

访问

Download Exploit EDB-23976 EXPLOIT
exploitdb

访问

ExploitDB EDB-23977 EXPLOIT
exploitdb

访问

Download Exploit EDB-23977 EXPLOIT
exploitdb

访问

ExploitDB EDB-23978 EXPLOIT
exploitdb

访问

Download Exploit EDB-23978 EXPLOIT
exploitdb

访问

ExploitDB EDB-23982 EXPLOIT
exploitdb

访问

Download Exploit EDB-23982 EXPLOIT
exploitdb

访问

ExploitDB EDB-23983 EXPLOIT
exploitdb

访问

Download Exploit EDB-23983 EXPLOIT
exploitdb

访问

ExploitDB EDB-23984 EXPLOIT
exploitdb

访问

Download Exploit EDB-23984 EXPLOIT
exploitdb

访问

ExploitDB EDB-43809 EXPLOIT
exploitdb

访问

Download Exploit EDB-43809 EXPLOIT
exploitdb

访问

CVE Reference: CVE-2004-1923 ADVISORY
cve.org

访问

CVE Reference: CVE-2004-1924 ADVISORY
cve.org

访问

CVE Reference: CVE-2004-1926 ADVISORY
cve.org

访问

CVE Reference: CVE-2004-1927 ADVISORY
cve.org

访问

CVE Reference: CVE-2004-1928 ADVISORY
cve.org

访问

CVSS评分详情

7.5

HIGH

CVSS向量: AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS版本: 2.0

机密性

PARTIAL

完整性

PARTIAL

可用性

PARTIAL

时间信息

发布时间:

2005-05-10 04:00:00

修改时间:

2024-08-08 01:07:49

创建时间:

2025-11-11 15:32:23

更新时间:

2026-01-26 02:17:54

利用信息

此漏洞有可利用代码！

利用代码数量: 16

利用来源:

未知未知未知未知未知未知未知未知未知未知未知未知未知未知未知未知

数据源详情

数据源	记录ID	版本	提取时间
CVE	`cve_CVE-2004-1925`	2025-11-11 15:17:30	2025-11-11 07:32:23
NVD	`nvd_CVE-2004-1925`	2025-11-11 14:50:54	2025-11-11 07:41:09
CNNVD	`cnnvd_CNNVD-200404-017`	2025-11-11 15:08:44	2025-11-11 07:48:53
EXPLOITDB	`exploitdb_EDB-23963`	2025-11-11 15:05:44	2025-11-11 08:19:50
EXPLOITDB	`exploitdb_EDB-23964`	2025-11-11 15:05:44	2025-11-11 08:19:50
EXPLOITDB	`exploitdb_EDB-23965`	2025-11-11 15:05:44	2025-11-11 08:19:50
EXPLOITDB	`exploitdb_EDB-23966`	2025-11-11 15:05:44	2025-11-11 08:19:50
EXPLOITDB	`exploitdb_EDB-23971`	2025-11-11 15:05:44	2025-11-11 08:19:50
EXPLOITDB	`exploitdb_EDB-23972`	2025-11-11 15:05:44	2025-11-11 08:19:50
EXPLOITDB	`exploitdb_EDB-23973`	2025-11-11 15:05:44	2025-11-11 08:19:50
EXPLOITDB	`exploitdb_EDB-23974`	2025-11-11 15:05:44	2025-11-11 08:19:50
EXPLOITDB	`exploitdb_EDB-23975`	2025-11-11 15:05:44	2025-11-11 08:19:50
EXPLOITDB	`exploitdb_EDB-23976`	2025-11-11 15:05:44	2025-11-11 08:19:50
EXPLOITDB	`exploitdb_EDB-23977`	2025-11-11 15:05:44	2025-11-11 08:19:50
EXPLOITDB	`exploitdb_EDB-23978`	2025-11-11 15:05:44	2025-11-11 08:19:50
EXPLOITDB	`exploitdb_EDB-23982`	2025-11-11 15:05:44	2025-11-11 08:19:50
EXPLOITDB	`exploitdb_EDB-23983`	2025-11-11 15:05:44	2025-11-11 08:19:50
EXPLOITDB	`exploitdb_EDB-23984`	2025-11-11 15:05:44	2025-11-11 08:19:50
EXPLOITDB	`exploitdb_EDB-43809`	2025-11-11 15:05:44	2025-11-11 08:46:25

版本与语言

当前版本: v19

主要语言: EN

支持语言:

EN ZH

其他标识符:

安全公告

暂无安全公告信息

变更历史

v19 EXPLOITDB

2025-11-11 16:46:25

references_count: 36 → 43; tags_count: 18 → 20

查看详细变更

references_count: 36 -> 43
tags_count: 18 -> 20

v18 EXPLOITDB

2025-11-11 16:19:50

references_count: 34 → 36; tags_count: 17 → 18

查看详细变更

references_count: 34 -> 36
tags_count: 17 -> 18

v17 EXPLOITDB

2025-11-11 16:19:50

references_count: 32 → 34; tags_count: 16 → 17

查看详细变更

references_count: 32 -> 34
tags_count: 16 -> 17

v16 EXPLOITDB

2025-11-11 16:19:50

references_count: 30 → 32; tags_count: 15 → 16

查看详细变更

references_count: 30 -> 32
tags_count: 15 -> 16

v15 EXPLOITDB

2025-11-11 16:19:50

references_count: 28 → 30; tags_count: 14 → 15

查看详细变更

references_count: 28 -> 30
tags_count: 14 -> 15

v14 EXPLOITDB

2025-11-11 16:19:50

references_count: 26 → 28; tags_count: 13 → 14

查看详细变更

references_count: 26 -> 28
tags_count: 13 -> 14

v13 EXPLOITDB

2025-11-11 16:19:50

references_count: 24 → 26; tags_count: 12 → 13

查看详细变更

references_count: 24 -> 26
tags_count: 12 -> 13

v12 EXPLOITDB

2025-11-11 16:19:50

references_count: 22 → 24; tags_count: 11 → 12

查看详细变更

references_count: 22 -> 24
tags_count: 11 -> 12

v11 EXPLOITDB

2025-11-11 16:19:50

references_count: 20 → 22; tags_count: 10 → 11

查看详细变更

references_count: 20 -> 22
tags_count: 10 -> 11

v10 EXPLOITDB

2025-11-11 16:19:50

references_count: 18 → 20; tags_count: 9 → 10

查看详细变更

references_count: 18 -> 20
tags_count: 9 -> 10

v9 EXPLOITDB

2025-11-11 16:19:50

references_count: 16 → 18; tags_count: 8 → 9

查看详细变更

references_count: 16 -> 18
tags_count: 8 -> 9

v8 EXPLOITDB

2025-11-11 16:19:50

references_count: 14 → 16; tags_count: 7 → 8

查看详细变更

references_count: 14 -> 16
tags_count: 7 -> 8

v7 EXPLOITDB

2025-11-11 16:19:50

references_count: 12 → 14; tags_count: 6 → 7

查看详细变更

references_count: 12 -> 14
tags_count: 6 -> 7

v6 EXPLOITDB

2025-11-11 16:19:50

references_count: 10 → 12; tags_count: 5 → 6

查看详细变更

references_count: 10 -> 12
tags_count: 5 -> 6

v5 EXPLOITDB

2025-11-11 16:19:50

references_count: 8 → 10; tags_count: 4 → 5

查看详细变更

references_count: 8 -> 10
tags_count: 4 -> 5

v4 EXPLOITDB

2025-11-11 16:19:50

references_count: 5 → 8; tags_count: 0 → 4; data_sources: ['cnnvd', 'cve', 'nvd'] → ['cnnvd', 'cve', 'exploitdb', 'nvd']

查看详细变更

references_count: 5 -> 8
tags_count: 0 -> 4
data_sources: ['cnnvd', 'cve', 'nvd'] -> ['cnnvd', 'cve', 'exploitdb', 'nvd']

v3 CNNVD

2025-11-11 15:48:53

vulnerability_type: 未提取 → SQL注入; cnnvd_id: 未提取 → CNNVD-200404-017; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']

查看详细变更

vulnerability_type: 未提取 -> SQL注入
cnnvd_id: 未提取 -> CNNVD-200404-017
data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']

v2 NVD

2025-11-11 15:41:09

severity: SeverityLevel.MEDIUM → SeverityLevel.HIGH; cvss_score: 未提取 → 7.5; cvss_vector: NOT_EXTRACTED → AV:N/AC:L/Au:N/C:P/I:P/A:P; cvss_version: NOT_EXTRACTED → 2.0; affected_products_count: 0 → 2; data_sources: ['cve'] → ['cve', 'nvd']

查看详细变更

severity: SeverityLevel.MEDIUM -> SeverityLevel.HIGH
cvss_score: 未提取 -> 7.5
cvss_vector: NOT_EXTRACTED -> AV:N/AC:L/Au:N/C:P/I:P/A:P
cvss_version: NOT_EXTRACTED -> 2.0
affected_products_count: 0 -> 2
data_sources: ['cve'] -> ['cve', 'nvd']

CVE-2004-1925 (CNNVD-200404-017)

中文标题:

TikiWiki项目多个输入验证漏洞

英文标题:

Multiple SQL injection vulnerabilities in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allow remo...

漏洞描述

中文描述:

英文描述:

CWE类型:

标签:

受影响产品

解决方案

中文解决方案:

英文解决方案:

临时解决方案:

参考链接

CVSS评分详情

时间信息

利用信息

数据源详情

版本与语言

安全公告

变更历史