|
|
Info |
Last Modified |
| 6 months ago |
|
|
|
|
Description |
JAF CMS contains a flaw that may lead to an unauthorized disclosure. The issue is triggered when the index.php script is passed certain invalid input to the "id" parameter, which will disclose the product's installation path, resulting in a loss of confidentiality.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Information Disclosure
Impact:
Loss of Confidentiality
Exploit:
Exploit Available
OSVDB:
Web Related
|
|
Technical |
Subsequent evaluation indicates this vulnerability may be more serious, potentially allowing for arbitrary file inclusion or modification.
|
|
Solution |
Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround: edit php.ini to set "log_errors" on and "display_error" off.
|
|
Products |
|
JAF CMS
 |
3.0 |
|
|
|
|
|
Credit |
- Dedi Dwianto - the_day
 echo.or.id -
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
