Description
MyScrapbook 3.1 allows remote attackers to obtain sensitive information via a direct request to files in the txt-db-api directory such as txt-db-api/sql.php, which reveals the path in an error message.
References
- 20060611 Myscrapbook v3.1 - XSS mailing-list
- ADV-2006-2311 vdb-entry
- 20599 third-party-advisory
- 26414 vdb-entry
- myscrapbook-sql-path-disclosure(27165) vdb-entry