Description
w-agora 4.2.1 allows remote attackers to obtain sensitive information by via the (1) bn[] array parameter to index.php, which expects a string, and (2) certain parameters to delete_forum.php, which displays the path name in the resulting error message.
References
- wagora-deleteforumindex-path-disclosure(33076) vdb-entry
- 20070319 w-agora version 4.2.1 Multiple Path Disclosure Vulnerabilities mailing-list
- 31669 vdb-entry
- 31668 vdb-entry
- 2461 third-party-advisory
- http://www.netvigilance.com/advisory0014