Mambo Site Server 4.0.11 - Full Path Disclosure

Author: euronymous
type: webapps
platform: php
port: 
date_added: 2002-12-12  
date_updated: 2012-10-19  
verified: 1  
codes: CVE-2002-2288;OSVDB-7510  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 22087.txt  

source: https://www.securityfocus.com/bid/6387/info

A vulnerability has been discovered in Mambo Site Server. Requesting the 'index.php' script with an invalid parameter will cause an error page to be generated containing the path of the Mambo script.

Information obtained by exploiting this issue may aid an attacker in launching further attacks against a target server.

It should be noted that this vulnerability was reported in Mambo Site Server 4.0.11. It is not yet known whether other versions are affected.

http://www.example.com/mambo/index.php?Itemid=invalidparameter