Tiki Wiki CMS Groupware up to 6.14/9.10 LTS/12.4 LTS/14.1 Calendar tiki-calendar.php viewmode missing authentication

Summaryinfo

A vulnerability was found in Tiki Wiki CMS Groupware up to 6.14/9.10 LTS/12.4 LTS/14.1. It has been classified as critical. Affected by this issue is some unknown functionality of the file tiki-calendar.php of the component Calendar Module. This manipulation of the argument viewmode causes missing authentication. This vulnerability is registered as CVE-2025-34113. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

Detailsinfo

A vulnerability classified as critical was found in Tiki Wiki CMS Groupware up to 6.14/9.10 LTS/12.4 LTS/14.1. Affected by this vulnerability is an unknown code block of the file tiki-calendar.php of the component Calendar Module. The manipulation of the argument viewmode with an unknown input leads to a missing authentication vulnerability. The CWE definition for the vulnerability is CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An authenticated command injection vulnerability exists in Tiki Wiki CMS versions ≤14.1, ≤12.4 LTS, ≤9.10 LTS, and ≤6.14 via the `viewmode` GET parameter in `tiki-calendar.php`. When the calendar module is enabled and an authenticated user has permission to access it, an attacker can inject and execute arbitrary PHP code. Successful exploitation leads to remote code execution in the context of the web server user.

The weakness was published by Dany Ouellet. The advisory is shared at tiki.org. This vulnerability is known as CVE-2025-34113 since 04/15/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details and also a public exploit are known.

It is possible to download the exploit at exploit-db.com. It is declared as proof-of-concept. By approaching the search of inurl:tiki-calendar.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Exploit-DB (39965) and EUVD (EUVD-2025-21426). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Groupware Software

Vendor

• Tiki

Name

• Wiki CMS Groupware

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7
• 6.8
• 6.9
• 6.10
• 6.11
• 6.12
• 6.13
• 6.14
• 9.10 LTS
• 12.4 LTS
• 14.0
• 14.1

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion