Description

MyBB 1.2.4 allows remote attackers to obtain sensitive information via the (1) action[] parameter to member.php, (2) imagehash[] parameter to captcha.php, and (3) a direct request to inc/datahandlers/event.php, which reveal the installation path in the resulting error message.

Remediation

References

CVE-2007-0689

Related Vulnerabilities

Oracle Database Server CVE-2019-2518 Vulnerability (CVE-2019-2518)

Drupal Core 8.5.x Remote Code Execution (8.5.0 - 8.5.10)

MySQL CVE-2016-0657 Vulnerability (CVE-2016-0657)

osTicket Session Fixation Vulnerability (CVE-2022-31888)

Piwigo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2023-34626)

Severity

Medium

Classification

CVE-2007-0689

Tags

Missing Update Known Vulnerabilities