Description
list.php in DigiOz Guestbook before 1.7.1 allows remote attackers to obtain sensitive information via a non-numeric page parameter, which displays the installation path in the resulting error message.
References
- http://www.netvigilance.com/advisory0006
- 1829 third-party-advisory
- digiozguestbook-list-path-disclosure(30067) vdb-entry
- 20061107 DigiOz Guestbook version 1.7 Path Disclosure mailing-list
- 29985 vdb-entry
- 20061107 DigiOz Guestbook version 1.7 Path Disclosure mailing-list