CVE-2009-3815

2022-10-0316:23:57

mitre

www.cve.org

runcms

sensitive information

error_reporting

6.2 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

71.0%

JSON

RunCMS 2M1, when running with certain error_reporting levels, allows remote attackers to obtain sensitive information via (1) the op[] parameter to modules/contact/index.php or (2) uid[] parameter to userinfo.php, which leaks the installation path in an error message when these parameters are used in a call to the preg_match function.

References

retrogod.altervista.org/9sg_runcms_forum_sql.html