CVE-2011-3751: Infoleak
LifeType 1.2.10 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by plugins/badbehavior/pluginbadbehavior.class.php.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is remotely exploitable with no authentication required. An attacker needs only to make a direct request to an affected PHP file, such as plugins/badbehavior/pluginbadbehavior.class.php.
What information is exposed?
A PHP error message can reveal the LifeType installation path. The available data identifies information disclosure only; it does not indicate impact to integrity or availability.
How can I check whether an installation is affected?
Test whether a direct request to plugins/badbehavior/pluginbadbehavior.class.php produces an error that discloses the server-side installation path. Perform this check only against systems you are authorized to test.