Test ID:	1.3.6.1.4.1.25623.1.0.902651
Category:	Web application abuses
Title:	Tiki Wiki CMS Groupware 'show_errors' Parameter Stored XSS Vulnerability
Summary:	Tiki Wiki CMS Groupware is prone to a stored cross-site; scripting (XSS) vulnerability.
Description:	Summary: Tiki Wiki CMS Groupware is prone to a stored cross-site scripting (XSS) vulnerability. Vulnerability Insight: The flaw is due to improper validation of user-supplied input to 'show_errors' parameter in 'tiki-cookie-jar.php', 'tiki-login.php' and 'tiki-remind_password.php' script, which allows attackers to conduct stored XSS by sending a crafted request with JavaScript. Vulnerability Impact: Successful exploitation will allow remote attackers to insert arbitrary HTML and script code, which will be executed in a user's browser session in the context of an affected site. Affected Software/OS: Tiki Wiki CMS Groupware versions prior to 6.5 LTS and 8.2. Solution: Update to version 6.5 LTS, 8.2 or later. CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2011-4551 http://www.infoserve.de/system/files/advisories/INFOSERVE-ADV2011-07.txt http://www.osvdb.org/77966 http://secunia.com/advisories/47278
Copyright	Copyright (C) 2011 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.