CVE-2006-5702: Tikiwiki empty sort_mode parameter exposes MySQL credentials

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityUnauthenticated credential disclosure with public exploit references and very high EPSS, though the CVSS v2 score is only 5.0.

What it is

Tikiwiki 1.9.5 fails to handle an empty sort_mode parameter safely across 21 scripts, causing database error messages that disclose the MySQL username and password. Because the leaked credentials grant direct database access, this is more serious than a typical information disclosure.

Impact

An unauthenticated attacker learns the MySQL username and password, enabling direct database access to read or alter application data.

Attack surface

Reachable over the network by sending requests with an empty sort_mode parameter to any of the listed Tikiwiki scripts; no authentication or user interaction is required per the AV:N/AC:L/Au:N vector.

Exploitation

No CISA KEV listing, but EPSS is 0.53321 (99th percentile) and a SecurityFocus reference is tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade Tikiwiki to a version later than 1.9.5 that fixes the empty sort_mode handling, or apply the vendor/Gentoo GLSA-200611-11 update.
• Suppress database error output in production so credentials are never rendered to users.
• Rotate the MySQL credentials used by Tikiwiki, since they may already be exposed.
• Restrict database account privileges and network access to the database server.

Detection

• Search web logs for requests to the listed Tikiwiki scripts with an empty or missing sort_mode parameter.
• Monitor application responses for database error strings containing MySQL credentials.
• Alert on unexpected direct connections to the MySQL server from non-application hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.