CVE-2006-5832: Medium severity AIOCP AIOCP vulnerability
All In One Control Panel (AIOCP) 1.3.007 and earlier allows remote attackers to obtain the full path of the web server via certain requests to (1) public/code/cpdpage.php, possibly involving the aiocpdp[] parameter, (2) public/code/cpshowecproducts.php, possibly involving the orderfield[] parameter, and (3) public/code/cpshowpagehelp.php, possibly involving the hp[] parameter, which reveal the path in various error messages.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Remote attackers can trigger the path disclosure without authentication. The affected inputs are reachable through requests to public/code/cp_dpage.php, public/code/cp_show_ec_products.php, and public/code/cp_show_page_help.php.
What information can be exposed?
Error messages can reveal the full filesystem path of the web server. The described impact is limited to confidentiality; no integrity or availability impact is specified.
Which versions are affected?
AIOCP 1.3.007 and earlier are affected.
Which parameters are associated with the vulnerable requests?
The reported parameters are aiocp_dp[] for cp_dpage.php, order_field[] for cp_show_ec_products.php, and hp[] for cp_show_page_help.php. The reports describe these parameters as possibly involved in producing the error messages.