← back
CVE-2012-3996

CVE-2012-3996

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 4.6%
from disclosure to weapon0 days
Published on NVDJul 12
1st PoCJul 4
exploitation probability
4.6%top 9% of all CVEs
observed exploitation
nono source reports it
4 public exploit(s)
TikiWiki CMS/Groupware 8.3 and earlier allows remote attackers to obtain the installation path via a direct request to (1) admin/include_calendar.php, (2) tiki-rss_error.php, or (3) tiki-watershed_service.php.
Affected products
n/a · n/a
public PoCs found — 4✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/19573exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/19630cve_referencewww.exploit-db.com/exploits/19573unverifiedcve_referencewww.exploit-db.com/exploits/19630unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://archives.neohapsis.com/archives/bugtraq/2012-07/0020.htmlhttp://dev.tiki.org/item4109http://info.tiki.org/article190-Tiki-Wiki-CMS-Groupware-Updates-Tiki-6-7-LTShttp://info.tiki.org/article191-Tiki-Releases-8-4http://www.exploit-db.com/exploits/19573http://www.exploit-db.com/exploits/19630http://www.osvdb.org/83533