PHP Object Injection Vulnerability in Tiki’s Spreadsheets Feature
CVE-2023-22850

8.8HIGH

Key Information:

Vendor

Tiki

Status
Tiki
Vendor
CVE Published:
14 January 2023

What is CVE-2023-22850?

A vulnerability exists in Tiki prior to version 24.1 due to insecure handling of serialized data in the Spreadsheets feature. Specifically, the issue arises from an unserialize function call in the lib/sheet/grid.php file, which allows an attacker to inject and manipulate PHP objects. This could lead to unauthorized access or execution of malicious code, posing significant risks to the security of applications built on this platform.

References

https://tiki.org/articles
https://karmainsecurity.com/KIS-2023-03

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.