A vulnerability identified in PHP-Nuke can be exploited by malicious people to gain knowledge of system information.

The PHP script "print.php" used by the modules "News" and "AvantGo" does not verify user input supplied to the "$sid" variable. A malicious person can exploit this to gain knowledge of the full path to the installation directory by sending a HTTP request including invalid input to the "$sid" variable.

Solution
Edit the source code to validate user input.

Provided and/or discovered by
XyBØrG

Deep Links
Links available in Customer Area