Description
Geeklog 1.4.0sr2 and earlier allows remote attackers to obtain the full installation path via a direct request and possibly invalid arguments to (1) layout/professional/functions.php or (2) getimage.php.
References
- http://www.geeklog.net/index.php?topic=Security
- 993 third-party-advisory
- 20060529 [KAPDA::#45] - geeklog multiple vulnerabilities mailing-list
- ADV-2006-2050 vdb-entry
- http://kapda.ir/advisory-336.html
- geeklog-multiple-path-disclosure(26864) vdb-entry
- 20316 third-party-advisory
- 18154 vdb-entry