CVE-2001-1437 easyScripts easyNews 1.5 allows remote attackers to obtain the full path of the web root via a view request with a non-integer news message id field, which leaks the path in a PHP error message when t...
HighCVSS 7.5
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
easyScripts easyNews 1.5 allows remote attackers to obtain the full path of the web root via a view request with a non-integer news message id field, which leaks the path in a PHP error message when the script times out.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| easyscripts easynews | <= 1.5 | No fix listed |
References
- 20011201 easynews 1.5 let's remote users modify database exploit mailing-list
- VU#597795 third-party-advisory us-government-resource
- 3649 exploit vdb-entry
- easynews-php-reveal-path(7660) vdb-entry