CVE-2006-1809: Medium severity lifetype lifetype vulnerability
Published Apr 18, 2006
·Updated
index.php in Lifetype 1.0.3 allows remote attackers to obtain sensitive information via an invalid show parameter, which reveals the path in an error message.
Affected Software
1 affected component
Lifetype LifeType=1.0.3
Event History
Apr 18, 2006
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
Who can exploit this issue?
Any remote attacker can trigger it over the network; no authentication is required. The disclosed information is limited to filesystem path details shown in an error message.
2
What input is needed to trigger the information disclosure?
An attacker must send an invalid value in the show parameter to index.php. The resulting error message can reveal the affected installation's path.