S1lkys / Cve 2020 15906
Programming Languages
Labels
Projects that are alternatives of or similar to Cve 2020 15906
CVE-2020-15906
Writeup of CVE-2020-15906. Special Thanks to Frederic Mohr(Lastbreach) for your Backend Support.
Tiki Wiki Cms Groupware 16.x - 21.1 Authentication Bypass by Maximilian Barz
I have found a new vulnerability in TikiWiki Cms Groupware 16.x - 21.1. It allows remote unauthenticated attackers to bypass the login page which results in a full compromise of Tiki Wiki CMS. An Attacker is able to bruteforce the Admin account until it is locked. After that an empty Password can be used to authenticate as admin to get access.
Affected file: tiki-login.php
CVSS 3.1 Base Score: 9.3
Walkthrough/ PoC:
Normal condition
Take a look at the database. This is what the admin looks like after Tiki was installed. (Note that provpass is empty)
Step 1
Admin Login Brute Force results in about 15 "Invalid user or password" errors, then the message should say "The mail cannot be sent" – maybe a verification problem because of to many requests
Step 2
Keep Brute Forcing, just to be sure. If the Mail cant be send a different error message appears. Just before the 50th request, the messages change again, now the account is locked.
Step 3
If we now take a look inside the DB, we can see provpass got set.
Step 4
Now try another login attempt, but remove the password from the request.
Result: Admin Access is granted.
A full walkthrough video can be viewed on youtube (Videos are not publicly available.): https://www.youtube.com/watch?v=v2YEpMsxcbA
PoC Exploit video on youtube: https://youtu.be/o3blz2US54Y
Exploit-DB:
https://www.exploit-db.com/exploits/48927
Article on Portswigger.net
Credits:
Maximilian Barz (OSCP), Email: [email protected], Twitter: S1lky_1337