Description
Bitrix Site Manager 4.0.x allows remote attackers to obtain sensitive information via direct request to (1) subscr_form.php or (2) dbquery_error.php, which reveals the path in an error message.
References
- 20050615 Vulnerability: Bitrix Web Server Paths mailing-list
- 17348 vdb-entry
- 17376 vdb-entry
- bitrix-site-path-disclosure(21019) vdb-entry