Sage 1.0 Beta 3 - Content Management System Full Path Disclosure

2003-02-20T00:00:00
ID EXPLOITPACK:C0E3F89248FAA90836CCE0402C934E91
Type exploitpack
Reporter euronymous
Modified 2003-02-20T00:00:00

Description

Sage 1.0 Beta 3 - Content Management System Full Path Disclosure

                                        
                                            source: https://www.securityfocus.com/bid/6893/info

Sage Content Management System contains a path disclosure vulnerability. When a request is made for a module that does not exist, the returned error message contains the full path to the Sage installation directory.

Disclosed path information could be used to launch further attacks against the system. 

http://hostname/?mod=some_thing&op=browse

http://hostname/?mod=node&nid=some_thing&op=view