Description
index.php in @lex Guestbook 4.0.1 allows remote attackers to obtain sensitive information via a skin parameter referencing a nonexistent skin, which reveals the installation path in an error message.
References
- ADV-2006-4807 vdb-entry
- 1964 third-party-advisory
- @lexguestbook-index-path-disclosure(30638) vdb-entry
- 21373 vdb-entry
- 23181 third-party-advisory
- 20061130 @lex Guestbook 4.0.1 : Full Path Disclosure & XSS mailing-list