CVE-2007-6607 OpenBiblio 0.5.2-pre4 and earlier allows remote attackers to obtain sensitive information via a direct request for (1) shared/footer.php, (2) circ/mbr_fields.php, or (3) admin/custom_marc_form_fields....
MediumCVSS 5.0
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenBiblio 0.5.2-pre4 and earlier allows remote attackers to obtain sensitive information via a direct request for (1) shared/footer.php, (2) circ/mbr_fields.php, or (3) admin/custom_marc_form_fields.php, which reveals the path in various error messages.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openbiblio | = 0.2 | No fix listed |
| openbiblio | = 0.2.1 | No fix listed |
| openbiblio | = 0.3 | No fix listed |
| openbiblio | = 0.5.1 | No fix listed |
| openbiblio | = 0.5.2 | No fix listed |
| openbiblio | = 0.5.2_pre4 | No fix listed |
References
- 41286 vdb-entry
- 41287 vdb-entry
- 41288 vdb-entry
- 3502 third-party-advisory
- sourceforge.net
- sourceforge.net
- 20071228 OpenBiblio 0.5.2-pre4 and prior multiple vulnerabilities mailing-list
- 27053 exploit patch vdb-entry
- openbiblio-multiple-scripts-path-disclosure(39295) vdb-entry