CVE-2006-5702
Tikiwiki 1.9.5 - Exposure of Sensitive Information via Empty sort_mode Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-5702.
Includes Metasploit module auxiliary/admin/tikiwiki/tikidblib.
AI-analyzed exploit summary The exploit describes an information leakage vulnerability in Tikiwiki 1.9.5 (CVS) where an anonymous user can dump MySQL credentials by triggering a MySQL error via the 'sort_mode' parameter in multiple scripts. It also mentions an XSS vulnerability in 'tiki-featured_link.php'.
Description
Tikiwiki 1.9.5 allows remote attackers to obtain sensitive information (MySQL username and password) via an empty sort_mode parameter in (1) tiki-listpages.php, (2) tiki-lastchanges.php, (3) messu-archive.php, (4) messu-mailbox.php, (5) messu-sent.php, (6) tiki-directory_add_site.php, (7) tiki-directory_ranking.php, (8) tiki-directory_search.php, (9) tiki-forums.php, (10) tiki-view_forum.php, (11) tiki-friends.php, (12) tiki-list_blogs.php, (13) tiki-list_faqs.php, (14) tiki-list_trackers.php, (15) tiki-list_users.php, (16) tiki-my_tiki.php, (17) tiki-notepad_list.php, (18) tiki-orphan_pages.php, (19) tiki-shoutbox.php, (20) tiki-usermenu.php, and (21) tiki-webmail_contacts.php, which reveal the information in certain database error messages.
Exploits (2)
The exploit describes an information leakage vulnerability in Tikiwiki 1.9.5 (CVS) where an anonymous user can dump MySQL credentials by triggering a MySQL error via the 'sort_mode' parameter in multiple scripts. It also mentions an XSS vulnerability in 'tiki-featured_link.php'.
This Metasploit module exploits an information disclosure vulnerability in TikiWiki 1.9.5 by triggering a MySQL error via the 'sort_mode' parameter, which leaks database credentials and configuration details.