CVE-2018-7304 | BDVDB-2026-96990 Detail

Description#

Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE or Calculator window on the victim machine to perform malicious activity, as demonstrated by an "=cmd|' /C calc'!A0" payload during User Creation.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12018-02-21Record published in the CVE List.
2. Version 22024-09-16Most recent update recorded in the CVE List.