CVE-2004-1925 - CVE House
Back to Database
Status published High CVE-2004-1925

Multiple SQL injection vulnerabilities in Tiki CMS/Groupware (TikiWiki) 1.8.1 and...

Vulnerability Description

Multiple SQL injection vulnerabilities in Tiki CMS/Groupware (TikiWiki) 1.8.1 and earlier allow remote attackers to execute arbitrary SQL commands via the sort_mode parameter in (1) tiki-usermenu.php, (2) tiki-list_file_gallery.php, (3) tiki-directory_ranking.php, (4) tiki-browse_categories.php, (5) tiki-index.php, (6) tiki-user_tasks.php, (7) tiki-directory_ranking.php, (8) tiki-directory_search.php, (9) tiki-file_galleries.php, (10) tiki-list_faqs.php, (11) tiki-list_trackers.php, (12) tiki-list_blogs.php, or via the offset parameter in (13) tiki-usermenu.php, (14) tiki-browse_categories.php, (15) tiki-index.php, (16) tiki-user_tasks.php, (17) tiki-list_faqs.php, (18) tiki-list_trackers.php, or (19) tiki-list_blogs.php.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2004-1925

Credits & Attribution

No credits recorded in the NVD database.

References

More from tiki

View All →
CVE-2021-36551
TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS)...
Medium 5.4
CVE-2021-36550
TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS)...
Medium 5.4
CVE-2020-29254
TikiWiki 21.2 allows templates to be edited without CSRF protection....
High 8.8
CVE-2020-16131
Tiki before 21.2 allows XSS because [\s\/"\'] is not properly...
Medium 6.1
CVE-2020-15906
tiki-login.php in Tiki before 21.2 sets the admin password to...
Critical 9.8

Affected Vendor

Affected Software

tikiwiki cms\/groupware
Vulnerable Versions:
0, 1.6.1

Timeline

Official Publish: May 10th, 2005
Last Modified: August 8th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.