Gossamer Threads DBMan 2.0.4 - DBMan Information Leakage



EKU-ID: 25484 CVE: CVE-2000-0381;OSVDB-306 OSVDB-ID:
Author: Black Watch Labs Published: 2000-05-05 Verified: Verified
Download:

Rating

☆☆☆☆☆
Home 


source: https://www.securityfocus.com/bid/1178/info

Requesting an invalid database file from a web server implementing Gossamer Threads DBMan scripts will return a CGI error message containing environmental variables to a remote user without any authorization. The parameters displayed include the local document root path, server administrator account name, web server software, platform, etc.

http://target/scripts/dbman/db.cgi?db=invalid-db