YaBBSe 1.5.5c Path disclosure problem

July 15, 2005

Software Vendor:

http://sourceforge.net/projects/yabbse/

A path disclosure vuln exist in the ssi_examples.php
file. Exploitation is simple:

http://www.yoursite.com/pathtoforum/ssi_examples.php

The script show us the full path.

Solution: Remove ssi_examples.php. The file isn’t
needed by the forum.

Mail : priest@priestmaster.org
Url : http://www.priestmaster.org

greets,

priestmaster

Posted in Exploits and Bugs