Description
PhpList allows remote attackers to obtain sensitive information via a direct request to (1) about.php, (2) connect.php, (3) domainstats.php or (4) usercheck.php in public_html/lists/admin directory, (5) attributes.php, (6) dbcheck.php, (7) importcsv.php, (8) user.php, (9) usermgt.php, or (10) users.php in admin/commonlib/pages directory, (11) helloworld.php, or (12) sidebar.php in public_html/lists/admin/plugins directory, or (13) main.php in public_html/lists/admin/plugsins/defaultplugin directory, which reveal the path in an error message.
References
- 18329 vdb-entry
- 18323 vdb-entry
- 18321 vdb-entry
- 18326 vdb-entry
- phplist-multiple-scripts-path-disclosure(21579) vdb-entry
- 18322 vdb-entry
- 18325 vdb-entry
- 18327 vdb-entry
- 18328 vdb-entry
- 18318 vdb-entry
- 18324 vdb-entry
- 18317 vdb-entry
- 20050728 PhpList Sql Injection and Path Disclosure mailing-list
- 18320 vdb-entry
- 18319 vdb-entry