Description
phpAdsNew and phpPgAds 2.0.6 and possibly earlier versions allows remote attackers to obtain the application installation path and other sensitive information via direct requests to (1) create.php, and if display_errors is enabled, (2) lib-updates.inc.php, (3) lib-targetstats.inc.php, (4) lib-size.inc.php, (5) lib-misc-stats.inc.php, (6) lib-hourly-hosts.inc.php, (7) lib-hourly.inc.php, (8) lib-history.inc.php, and (9) graph-daily.php.
References
- http://www.fitsec.com/advisories/FS-05-01.txt
- 20740 vdb-entry
- 20743 vdb-entry
- 20051110 [FS-05-01] Multiple vulnerabilities in phpAdsNew mailing-list
- 20737 vdb-entry
- 17464 third-party-advisory
- http://sourceforge.net/project/shownotes.php?group_id=36679&release_id=370942
- 20739 vdb-entry
- 20735 vdb-entry
- 20051115 [PHPADSNEW-SA-2005-002] phpAdsNew and phpPgAds 2.0.7 fix multiple vulnerabilities mailing-list
- 171 third-party-advisory
- 20738 vdb-entry
- 20741 vdb-entry
- phpadsnew-multiple-path-disclosure(23043) vdb-entry
- ADV-2005-2380 vdb-entry
- 20742 vdb-entry
- 20736 vdb-entry