CVE-2024-46878: Tiki Wiki CMS XSS Vulnerability

CVE-2024-46878 Overview

A Cross-Site Scripting (XSS) vulnerability exists in the page parameter of tiki-editpage.php in Tiki CMS version 26.3 and earlier. This vulnerability allows attackers to execute arbitrary JavaScript code via a crafted payload, leading to potential access to sensitive information or unauthorized actions within the context of an authenticated user's session.

Critical Impact

Attackers can inject malicious JavaScript that executes in victims' browsers, potentially stealing session cookies, performing unauthorized actions, or redirecting users to malicious sites.

Affected Products

• Tiki CMS version 26.3 and earlier
• Tiki CMS 26.x LTS branch (prior to security update)
• Tiki CMS 24.x LTS branch (prior to security update)

Discovery Timeline

• 2026-03-23 - CVE CVE-2024-46878 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2024-46878

Vulnerability Analysis

This vulnerability is classified as Cross-Site Scripting (XSS) under CWE-79: Improper Neutralization of Input During Web Page Generation. The flaw exists in the page editing functionality of Tiki CMS, specifically within the tiki-editpage.php script. When a user navigates to edit a page, the page parameter is not properly sanitized before being reflected back in the response, allowing an attacker to inject malicious script content.

The attack requires user interaction, as a victim must click on a maliciously crafted link or visit a page containing the malicious URL. Once triggered, the injected JavaScript executes within the security context of the victim's authenticated session, potentially allowing attackers to steal credentials, hijack sessions, or perform actions on behalf of the user.

Root Cause

The root cause of this vulnerability is insufficient input validation and output encoding on the page parameter within tiki-editpage.php. The application fails to properly sanitize user-controlled input before incorporating it into the HTML response, enabling injection of arbitrary JavaScript code.

Attack Vector

The attack is network-based and requires low-level privileges (an authenticated user account) and user interaction. An attacker would craft a malicious URL containing JavaScript payload in the page parameter and trick a victim into clicking the link. This could be accomplished through phishing emails, forum posts, or other social engineering techniques.

The vulnerability exploitation flow involves the attacker sending a specially crafted request to tiki-editpage.php with malicious script content in the page parameter. When the victim accesses this URL, the server reflects the unvalidated input back to the browser, which executes the malicious JavaScript.

For technical details and proof-of-concept information, refer to the GitHub PoC repository for CVE-2024-46878.

Detection Methods for CVE-2024-46878

Indicators of Compromise

• Unusual requests to tiki-editpage.php containing JavaScript snippets or encoded script tags in URL parameters
• Presence of <script> tags, event handlers (e.g., onerror, onload), or javascript: URIs in the page parameter
• Server logs showing requests with URL-encoded JavaScript payloads targeting the page editing functionality
• Reports from users about unexpected redirects or pop-ups when accessing Tiki CMS pages

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block requests containing XSS patterns in the page parameter
• Configure IDS/IPS signatures to identify common XSS attack payloads in HTTP requests to tiki-editpage.php
• Deploy Content Security Policy (CSP) headers to prevent inline script execution and report violations
• Monitor application logs for anomalous parameter values containing HTML or JavaScript syntax

Monitoring Recommendations

• Enable verbose logging on the Tiki CMS application to capture all requests to tiki-editpage.php
• Set up alerts for high volumes of requests with unusual characters or encoded payloads in URL parameters
• Implement real-time monitoring of CSP violation reports to identify attempted XSS attacks
• Review access logs regularly for patterns consistent with XSS reconnaissance or exploitation attempts

How to Mitigate CVE-2024-46878

Immediate Actions Required

• Update Tiki CMS to the latest patched version as recommended in the Tiki Security Update Advisory
• If immediate patching is not possible, restrict access to tiki-editpage.php to trusted administrators only
• Deploy a Web Application Firewall with XSS protection rules in front of the Tiki CMS installation
• Enable Content Security Policy (CSP) headers to mitigate the impact of any successful XSS exploitation

Patch Information

Tiki has released security updates addressing this vulnerability for versions 27.x, 26.x LTS, and 24.x LTS. Organizations running affected versions should upgrade immediately. Refer to the Tiki Security Update Advisory for specific patch versions and upgrade instructions. Additional information may be available in the Tiki Newsletter #8.

Workarounds

• Implement server-side input validation to sanitize the page parameter before processing
• Use a reverse proxy or WAF to filter requests containing XSS patterns before they reach the application
• Temporarily disable the page editing functionality for non-administrative users until the patch can be applied
• Configure HTTP response headers including X-XSS-Protection, X-Content-Type-Options, and strict CSP policies

# Apache .htaccess configuration to add security headers
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options "nosniff"
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"
Header set X-Frame-Options "SAMEORIGIN"