Unscored CVE-2007-0624 EUVD-2007-0622GHSA-24ff-pr42-8q5w

user.php in MAXdev MDPro 1.0.76 allows remote attackers to obtain the full path via a ' (quote) character, and possibly other invalid value…

Published Jan 31, 2007 · Updated Aug 7, 2024 · Assigned by mitre

Description

user.php in MAXdev MDPro 1.0.76 allows remote attackers to obtain the full path via a ' (quote) character, and possibly other invalid values, in the uname parameter in a userinfo operation.

References

20070129 MDPro 1.0.76 - Multiple Remote Vulnerabilities mailing-list
33613 vdb-entry
mdpro-user-path-disclosure(31898) vdb-entry
2198 third-party-advisory