Description
index.php in Vincent Leclercq News 5.2 allows remote attackers to obtain sensitive information, such as the installation path, via a mail[] parameter with invalid values.
References
- 20060629 News <= 5.2 XSS, SQL Injection, Full Path Disclosure mailing-list
- 20936 third-party-advisory
- vlcnews-index-path-disclosure(27506) vdb-entry
- http://www.acid-root.new.fr/advisories/news52.txt