Description
property.php in Widget Property 1.1.19 allows remote attackers to obtain the full server path via an invalid lang value, which leaks the path in the resulting error message.
References
- 21427 vdb-entry
- http://pridels0.blogspot.com/2005/12/widget-property-vuln.html
- 17829 third-party-advisory