Description
TellMe 1.2 and earlier, when the Server (o_Server) and HEAD (o_Head) options are enabled, allows remote attackers to obtain sensitive information via an invalid q_Host parameter, which reveals the full pathname of the application in an fsockopen error message.
References
- 19872 vdb-entry
- 20051005 Tellme 1.2 mailing-list
- tellme-index-path-disclosure(22523) vdb-entry
- http://exploitlabs.com/files/advisories/EXPL-A-2005-015-tellme.txt
- 17078 third-party-advisory