Description
myEvent 1.6 allows remote attackers to obtain sensitive information via (1) a Log In action without a password to login.php, or an invalid (2) view[] or (3) monthno[] parameter to myevent.php, which reveals the path in various error messages.
References
- myevent-myevent-login-path-disclosure(34542) vdb-entry
- 20070528 myEvent version 1.6 Multiple Path Disclosure Vulnerabilities mailing-list
- 38336 vdb-entry
- 34272 vdb-entry
- http://www.netvigilance.com/advisory0024
- 2744 third-party-advisory