CVE-2005-2474 - Secunia Advisories - Vulnerability Information

CVE Reference: CVE-2005-2474
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2005-2474

Description: ChurchInfo allows remote attackers to execute obtain sensitive information via the PersonID parameter to (1) PersonView.php, (2) MemberRoleChange.php, (3) PropertyAssign.php, (4) WhyCameEditor.php, (5) GroupPropsEditor.php, (6) Reports/PDFLabel.php, or (7) UserDelete.php, an invalid Number parameter to (8) SelectList.php or (9) SelectDelete.php, GroupID parameter to (10) GroupView.php, (11) GroupMemberList.php, (12) MemberRoleChange.php, (13) GroupDelete.php, (14) /Reports/ClassAttendance.php, or (15) /Reports/GroupReport.php, (16) PropertyID parameter to PropertyEditor.php, FamilyID parameter to (17) Canvas05Editor.php, (18) CanvasEditor.php, or (19) FamilyView.php, or (20) PledgeID parameter to PledgeDetails.php, which reveal the path in an error message.

CVE Status: Candidate

References: XF http://xforce.iss.net/xforce/xfdb/21648 ST 1014617 SAID Secunia Advisory: SA16292 OSVDB 18426 18425 18450 18439 18438 18437 18436 18435 18434 18433 18432 18431 18429 18430 BUGTRAQ http://marc.theaimsgroup.com/?l=bugtraq&m=112291550713546&w=2

Return to the previous page.