Multiple SQL injection vulnerabilities in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allow remote attackers to execute arbitrary SQL c…

Published 22 y ago 2004-04-12 · modified 4 mo ago 2026-06-16 · JSON

CVSS

7.5

v2.0 · NVD

CISA KEV

not known exploited

EPSS

1.2%

percentile 69%

Public exploits

Exploit-DB

Multiple SQL injection vulnerabilities in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allow remote attackers to execute arbitrary SQL commands via the sort_mode parameter in (1) tiki-usermenu.php, (2) tiki-list_file_gallery.php, (3) tiki-directory_ranking.php, (4) tiki-browse_categories.php, (5) tiki-index.php, (6) tiki-user_tasks.php, (7) tiki-directory_ranking.php, (8) tiki-directory_search.php, (9) tiki-file_galleries.php, (10) tiki-list_faqs.php, (11) tiki-list_trackers.php, (12) tiki-list_blogs.php, or via the offset parameter in (13) tiki-usermenu.php, (14) tiki-browse_categories.php, (15) tiki-index.php, (16) tiki-user_tasks.php, (17) tiki-list_faqs.php, (18) tiki-list_trackers.php, or (19) tiki-list_blogs.php.

Exploit prediction (EPSS)

1.21% probability of exploitation in the next 30 days, higher than 69% of all scored CVEs.

Exploits and detections

EDB-43809 TikiWiki < 1.8.1 - Multiple Vulnerabilities · webapps · 2004-04-11
EDB-23984 TikiWiki Project 1.8 - 'tiki-list_blogs.php?offset' SQL Injection · webapps · 2004-04-12
EDB-23983 TikiWiki Project 1.8 - 'tiki-list_trackers.php?offset' SQL Injection · webapps · 2004-04-12
EDB-23982 TikiWiki Project 1.8 - 'tiki-list_faqs.php?offset' SQL Injection · webapps · 2004-04-12
EDB-23978 TikiWiki Project 1.8 - 'tiki-usermenu.php?offset' SQL Injection · webapps · 2004-04-12
EDB-23977 TikiWiki Project 1.8 - 'tiki-list_blogs.php?sort_mode' SQL Injection · webapps · 2004-04-12
EDB-23976 TikiWiki Project 1.8 - 'tiki-list_trackers.php?sort_mode' SQL Injection · webapps · 2004-04-12
EDB-23975 TikiWiki Project 1.8 - 'tiki-list_faqs.php?sort_mode' SQL Injection · webapps · 2004-04-12
EDB-23974 TikiWiki Project 1.8 - 'tiki-file_galleries.php?sort_mode' SQL Injection · webapps · 2004-04-12
EDB-23973 TikiWiki Project 1.8 - 'tiki-directory_search.php?sort_mode' SQL Injection · webapps · 2004-04-12
EDB-23972 TikiWiki Project 1.8 - 'tiki-user_tasks.php?offset & sort_mode' SQL Injections · webapps · 2004-04-12
EDB-23971 TikiWiki Project 1.8 - 'tiki-index.php?comments_offset & offset' SQL Injections · webapps · 2004-04-12
EDB-23966 TikiWiki Project 1.8 - 'tiki-browse_categories.php?sort_mode' SQL Injection · webapps · 2004-04-12
EDB-23965 TikiWiki Project 1.8 - 'tiki-directory_ranking.php?sort_mode' SQL Injection · webapps · 2004-04-12
EDB-23964 TikiWiki Project 1.8 - 'tiki-list_file_gallery.php?sort_mode' SQL Injection · webapps · 2004-04-12
EDB-23963 TikiWiki Project 1.8 - 'tiki-usermenu.php?sort_mode' SQL Injection · webapps · 2004-04-12

CVSS scores

Assigned by	Version	Score	Vector
NVD	2.0	7.5	`AV:N/AC:L/Au:N/C:P/I:P/A:P`

Classification

Weakness

CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

securityfocus.com /bid/10100 · vdb-entry, x_refsource_BID, x_transferred
marc.info /?l=bugtraq&m=108180073206947&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
secunia.com /advisories/11344 · third-party-advisory, x_refsource_SECUNIA, x_transferred
tikiwiki.org /tiki-read_article.php?articleId=66 · x_refsource_CONFIRM, x_transferred
exchange.xforce.ibmcloud.com /vulnerabilities/15845 · vdb-entry, x_refsource_XF, x_transferred

Sources

CVE List: CVE-2004-1925
NVD: CVE-2004-1925

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.