qdPM 8.3 allows remote attackers to obtain sensitive information via invalid ID value to index.php/users/info/id/[ID], which reveals the installation path in an error message.
References
Link | Resource |
---|---|
http://rossmarks.uk/whitepapers/qdPM_8.3.txt | Exploit Third Party Advisory |
http://rossmarks.uk/portfolio.php | Third Party Advisory |
Configurations
Information
Published : 2017-03-17 07:59
Updated : 2017-03-20 09:59
NVD link : CVE-2015-3882
Mitre link : CVE-2015-3882
JSON object : View
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
Products Affected
qdpm
- qdpm