Description
W-Agora (Web-Agora) 4.2.1, when register_globals is enabled, stores globals.inc under the web document root with insufficient access control, which allows remote attackers to obtain application path information via a direct request.
References
- 2465 third-party-advisory
- http://www.netvigilance.com/advisory0015
- wagora-globals-information-disclosure(33073) vdb-entry
- 20070319 w-agora version 4.2.1 Information Disclosure Vulnerability mailing-list
- 31670 vdb-entry
- 20070319 w-agora version 4.2.1 Information Disclosure Vulnerability mailing-list