CVE-2006-5702
Last modified
CVE-2006-5702 is a vulnerability of currently unknown severity. Tikiwiki 1.9.5 allows remote attackers to obtain sensitive information (MySQL username and password) via an empty sort_mode parameter in (1) tiki-listpages.php, (2) tiki-lastchanges.php, (3) messu-archive.php, (4) messu-mailbox.php, (5) messu-sent.php, (6) tiki-directory_add_site.php, (7) tiki-directory_ranking.php, (8) tiki-directory_search.php, (9) tiki-forums.php, (10) tiki-view_forum.php, (11) tiki-friends.php, (12) tiki-list_blogs.php, (13) tiki-list_faqs.php, (14) tiki-list_trackers.php, (15) tiki-list_users.php, (16) tiki-my_tiki.php, (17) tiki-notepad_list.php, (18) tiki-orphan_pages.php, (19) tiki-shoutbox.php, (20) tiki-usermenu.php, and (21) tiki-webmail_contacts.php, which reveal the information in certain database error messages.. EPSS estimates a 53.07% chance of exploitation in the next 30 days.
Description
Tikiwiki 1.9.5 allows remote attackers to obtain sensitive information (MySQL username and password) via an empty sort_mode parameter in (1) tiki-listpages.php, (2) tiki-lastchanges.php, (3) messu-archive.php, (4) messu-mailbox.php, (5) messu-sent.php, (6) tiki-directory_add_site.php, (7) tiki-directory_ranking.php, (8) tiki-directory_search.php, (9) tiki-forums.php, (10) tiki-view_forum.php, (11) tiki-friends.php, (12) tiki-list_blogs.php, (13) tiki-list_faqs.php, (14) tiki-list_trackers.php, (15) tiki-list_users.php, (16) tiki-my_tiki.php, (17) tiki-notepad_list.php, (18) tiki-orphan_pages.php, (19) tiki-shoutbox.php, (20) tiki-usermenu.php, and (21) tiki-webmail_contacts.php, which reveal the information in certain database error messages.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Tiki | Tikiwiki Cms\/Groupware | 1.9.5 |
References
- http://secunia.com/advisories/22678Vendor Advisory
- http://secunia.com/advisories/22678Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2006-5702?
How severe is CVE-2006-5702?
How do I fix CVE-2006-5702?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2006
- CVE-2006-5696Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2006-5697Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2006-5698Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2006-5699Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2006-5700Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2006-5701Double free vulnerability in squashfs module in the Linux ke…
- CVE-2006-5703Cross-site scripting (XSS) vulnerability in tiki-featured_li…
- CVE-2006-5704HP NonStop Server G06.29, when running Standard Security T65…
- CVE-2006-5705Multiple directory traversal vulnerabilities in plugins/wp-d…
- CVE-2006-5706Unspecified vulnerabilities in PHP, probably before 5.2.0, a…
- CVE-2006-5707SQL injection vulnerability in index.php in PHPEasyData Pro …
- CVE-2006-5708Multiple unspecified vulnerabilities in MDaemon and WorldCli…7.5
Are you affected by CVE-2006-5702?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST