Description
easyScripts easyNews 1.5 allows remote attackers to obtain the full path of the web root via a view request with a non-integer news message id field, which leaks the path in a PHP error message when the script times out.
References
- VU#597795 third-party-advisory
- 3649 vdb-entry
- easynews-php-reveal-path(7660) vdb-entry
- 20011201 easynews 1.5 let's remote users modify database mailing-list