CVE:CVE-2006-5702
CNNVD:CNNVD-200611-051
Tikiwiki远程攻击者在(1)tiki-listpages.php，(2)tiki-lastchanges.php，(3)messu-archive.php，(4)messu-mailbox.php，(5)messu-sent.php，(6)tiki-directory_add_site.php，(7)tiki-directory_ranking.php，(8)tiki-directory_search.php，(9)tiki-forums.php，(10)tiki-view_forum.php，(11)tiki-friends.php，(12)tiki-list_blogs.php，(13) tiki-list_faqs.php，(14) tiki-list_trackers.php，(15)tiki-list_users.php，(16)tiki-my_tiki.php，(17)tiki-notepad_list.php，(18)tiki-orphan_pages.php，(19)tiki-shoutbox.php，(20)tiki-usermenu.php和(21)tiki-webmail_contacts.php内的空的sort_mode参数，造成系统在某些数据库出错消息内泄漏信息，从而获取敏感信息(MySQL用户名和密码)。
solution:Upgrade tiki tikiwiki_cms/groupware to a higher version than 1.9.5,and avoid the version 1.9.5