Description
phpCOIN 1.2.3 and earlier stores messages based upon e-mail addresses, which allows remote authenticated users to read messages for other users by adding the sender's e-mail address as an "additional contact".
References
- 17959 vdb-entry
- phpcoin-emailaddress-information-disclosure(26499) vdb-entry
- 20088 third-party-advisory
- http://forums.phpcoin.com/index.php?showtopic=5941
- ADV-2006-1788 vdb-entry