Description
e107 0.615 allows remote attackers to obtain sensitive information via a direct request to (1) alt_news.php, (2) backend_menu.php, (3) clock_menu.php, (4) counter_menu.php, (5) login_menu.php, and other files, which reveal the full path in a PHP error message.
References
- e107-multiplescripts-path-disclosure(16277) vdb-entry
- http://www.waraxe.us/index.php?modname=sa&id=31
- 10436 vdb-entry
- 6525 vdb-entry
- 11740 third-party-advisory
- 20040529 [waraxe-2004-SA#031 - Multiple vulnerabilities in e107 version 0.615] mailing-list
- 20040529 [waraxe-2004-SA#031 - Multiple vulnerabilities in e107 version 0.615] mailing-list