Description
admin.php in SkyBlueCanvas 1.1 r237 allows remote authenticated administrators to obtain sensitive information via an invalid id parameter, which reveals the installation path in an error message.
References
- 35478 third-party-advisory
- skybluecanvas-admin-path-disclosure(51164) vdb-entry
- 20090612 [InterN0T] SkyBlueCanvas 1.1 r237 - Multiple Vulnerabilities mailing-list