CONTENTCustomizer Dialog.PHP Information Disclosure Vulnerability

Bugtraq ID:	26291
Class:	Design Error
CVE:	CVE-2007-5816
Remote:	Yes
Local:	No
Published:	Nov 01 2007 12:00AM
Updated:	Nov 15 2007 12:38AM
Credit:	d3hydr8 discovered this issue.
Vulnerable:	CONTENTCustomizer CONTENTCustomizer 3.1mp
Not Vulnerable:

CONTENTCustomizer Dialog.PHP Information Disclosure Vulnerability

CONTENTCustomizer is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to access sensitive information that may lead to further attacks.

CONTENTCustomizer 3.1mp is vulnerable; other versions may also be affected.

CONTENTCustomizer Dialog.PHP Information Disclosure Vulnerability

Attackers can use a browser to exploit this issue.

The following proof-of-concept URI is available:

http://www.example.com/dialog.php?action=editauthor&doc=pagename

CONTENTCustomizer Dialog.PHP Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

CONTENTCustomizer Dialog.PHP Information Disclosure Vulnerability

References:

• CONTENTCustomizer Homepage (CONTENTCustomizer)
  
• Vendor Homepage (phptoys.com)