CVE-2006-5703
Tikiwiki 1.9.5 - Cross-Site Scripting via url Parameter in tiki-featured_link.php
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-5703. PoCs published by securfrog.
AI-analyzed exploit summary This is a writeup describing an information leakage vulnerability in Tikiwiki 1.9.5 (CVS) -Sirius- where an anonymous user can dump MySQL credentials by manipulating the 'sort_mode' parameter in various scripts. It also mentions an XSS vulnerability in another endpoint.
Description
Cross-site scripting (XSS) vulnerability in tiki-featured_link.php in Tikiwiki 1.9.5 allows remote attackers to inject arbitrary web script or HTML via a url parameter that evades filtering, as demonstrated by a parameter value containing malformed, nested SCRIPT elements.
Exploits (1)
This is a writeup describing an information leakage vulnerability in Tikiwiki 1.9.5 (CVS) -Sirius- where an anonymous user can dump MySQL credentials by manipulating the 'sort_mode' parameter in various scripts. It also mentions an XSS vulnerability in another endpoint.