Info

Disclosure

Jun 04, 2005

Discovery

May 29, 2005

Dates

Exploit

Jun 04, 2005

Solution

Unknown

Description

YaPiG contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a non-integer value is passed to the phid variable in view.php, which will disclose installation path information resulting in a loss of confidentiality.

Classification

Location: Remote/Network Access Required
Attack Type: Information Disclosure, Input Manipulation
Impact: Loss of Confidentiality
Exploit: Exploit Available
OSVDB: Web Related

Solution

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Products

NaTaSaB	YaPiG	0.92.2
		0.93
		0.94

References

Security Tracker: 1014103
Secunia Advisory ID: 15600
Related OSVDB ID: 17115 17116 17117 17118 17120 17121
CVE ID: 2005-1885 (see also: NVD)
Other Advisory URL: http://secwatch.org/advisories/secwatch/20050530_yapig.txt
Vendor URL: http://yapig.sourceforge.net/

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/36218

Info

Disclosure

Discovery

Dates

Exploit

Solution

Description

Classification

Solution

Products

NaTaSaB

YaPiG

References

Credit