OSVDB ID: 17540 Title: JAF CMS index.php id Variable Path Disclosure |
Info |
|
|
Dates |
||||
|
|
Description |
JAF CMS contains a flaw that may lead to an unauthorized disclosure. The issue is triggered when the index.php script is passed certain invalid input to the "id" parameter, which will disclose the product's installation path, resulting in a loss of confidentiality. |
Classification |
Location:
Remote/Network Access Required
Attack Type: Information Disclosure Impact: Loss of Confidentiality Exploit: Exploit Available OSVDB: Web Related |
Solution |
Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround: edit php.ini to set "log_errors" on and "display_error" off. |
Products |
|
References |
|
Credit |
|
echo.or.id -