Description
MyBB 1.2.4 allows remote attackers to obtain sensitive information via the (1) action[] parameter to member.php, (2) imagehash[] parameter to captcha.php, and (3) a direct request to inc/datahandlers/event.php, which reveal the installation path in the resulting error message.
References
- 34155 vdb-entry
- 20070513 MyBB version 1.2.4 Multiple Path Disclosure Vulnerabilities mailing-list
- mybb-eventmembercaptcha-info-disclosure(34336) vdb-entry
- 35549 vdb-entry
- 35548 vdb-entry
- 20070513 MyBB version 1.2.4 Multiple Path Disclosure Vulnerabilities mailing-list
- http://www.netvigilance.com/advisory0017