Description
CuteNews 1.4.1 allows remote attackers to obtain sensitive information via a direct request to (1) /inc/show.inc.php or (2) /inc/functions.inc.php, which reveal the path in an error message.
References
- 25306 vdb-entry
- 860 third-party-advisory
- cutenews-multiple-path-disclosure(26271) vdb-entry
- 20060505 CuteNews 1.4.1 Multiple vulnerabilities mailing-list
- 25305 vdb-entry