TikiWiki allows for the disclosure of MySQL database authentication credentials and for cross-site scripting attacks.
|Package||www-apps/tikiwiki on all architectures|
|Affected versions||< 1.9.6|
|Unaffected versions||>= 1.9.6|
TikiWiki is an open source content management system written in PHP.
In numerous files TikiWiki provides an empty sort_mode parameter, causing TikiWiki to display additional information, including database authentication credentials, in certain error messages. TikiWiki also improperly sanitizes the "url" request variable sent to tiki-featured_link.php.
An attacker could cause a database error in various pages of a TikiWiki instance by providing an empty sort_mode request variable, and gain unauthorized access to credentials of the MySQL databases used by TikiWiki. An attacker could also entice a user to browse to a specially crafted URL that could run scripts in the scope of the user's browser.
There is no known workaround at this time.
All TikiWiki users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/tikiwiki-1.9.6"
November 20, 2006
November 20, 2006: 01