CVE-2019-15314

CVE-2019-15314

> [Description]
 > tiki/tiki-upload_file.php in Tiki 18.4 allows remote attackers to
 > upload JavaScript code that is executed upon visiting a
 > tiki/tiki-download_file.php?display&fileId= URI.
 >
 > ------------------------------------------
 >
 > [Additional Information]
 > File upload and JavaScript code injection.
 > http://127.0.0.1/tiki/tiki-upload_file.php
 >
 > The TikiWiki CMS application allows you to upload a JavaScript file in the "File Upload" module.
 > When viewing the uploaded file, the JavaScript code runs in the client browser.
 >
 > The injected JavaScript code is stored by the application and executed every time someone views it.
 > ["Browser display (Raw / Download)"]
 > http://127.0.0.1/tiki/tiki-download_file.php?fileId=17&display
 >
 > ------------------------------------------
 >
 > [Vulnerability Type]
 > Cross Site Scripting (XSS)
 >
 > ------------------------------------------
 >
 > [Vendor of Product]
 > https://tiki.org/HomePage
 >
 > ------------------------------------------
 >
 > [Affected Product Code Base]
 > Tiki Wiki CMS - 18.4
 >
 > ------------------------------------------
 >
 > [Affected Component]
 > Affected component: tiki-upload_file.php
 >
 > ------------------------------------------
 >
 > [Attack Type]
 > Remote
 >
 > ------------------------------------------
 >
 > [Impact Code execution]
 > true
 >
 > ------------------------------------------
 >
 > [Attack Vectors]
 > Client side JavaScript code injection.
 >
 > ------------------------------------------
 >
 > [Reference]
 > https://tiki.org/HomePage

 Use CVE-2019-15314.