Description

MyBB 1.2.4 allows remote attackers to obtain sensitive information via the (1) action[] parameter to member.php, (2) imagehash[] parameter to captcha.php, and (3) a direct request to inc/datahandlers/event.php, which reveal the installation path in the resulting error message.

Remediation

References

CVE-2007-0689

Related Vulnerabilities

Joomla Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2015-7858)

WordPress Plugin Persian Woocommerce SMS Cross-Site Scripting (3.3.2)

WordPress Plugin AI ChatBot Cross-Site Scripting (4.9.6)

WordPress Plugin Advanced File Manager Information Disclosure (5.2.4)

phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-15727)

Severity

Medium

Classification

CVE-2007-0689

Tags

Missing Update Known Vulnerabilities