Description
DCP-Portal 3.7 through 4.5 allows remote attackers to obtain the physical path of the server via (1) a direct request to add_user.php, or via an invalid new_language parameter in (2) contents.php, (3) categories.php, or (4) files.php, which leaks the path in an error message.
References
- dcpportal-adduser-path-disclosure(8196) vdb-entry
- http://www.dcp-portal.com/files.php?action=viewcat&fcat_id=1
- 4113 vdb-entry
- 20020215 [ARL02-A02] DCP-Portal Root Path Disclosure Vulnerability mailing-list
- 20020228 [ARL02-A04] DCP-Portal System Information Path Disclosure mailing-list
- dcpportal-language-path-disclosure(8310) vdb-entry