DCForum 'auth_user_file.txt' File Multiple Information Disclosure Vulnerabilities

Bugtraq ID:	56383
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 02 2012 12:00AM
Updated:	Nov 02 2012 12:00AM
Credit:	r45c4l
Vulnerable:	DC Scripts DCForum 0
Not Vulnerable:

DCForum 'auth_user_file.txt' File Multiple Information Disclosure Vulnerabilities

DCForum is prone to multiple information-disclosure vulnerabilities.

Exploiting these issues may allow an attacker to obtain sensitive information that may aid in further attacks.

DCForum 'auth_user_file.txt' File Multiple Information Disclosure Vulnerabilities

The following example URI is available:

http://www.example.com/cgi-bin/User_info/auth_user_file.txt
http://www.example.com/cgi-bin/dcforum/User_info/auth_user_file.txt

DCForum 'auth_user_file.txt' File Multiple Information Disclosure Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

DCForum 'auth_user_file.txt' File Multiple Information Disclosure Vulnerabilities

References:

• DCForum Download Page (DC Scripts)
  
• DCScripts DCForum Homepage (DCScripts)