Path Disclosure Vulnerability in Exponent 0.95 by Exponent CMS

CVE-2005-0310

What is CVE-2005-0310?

Exponent 0.95 is susceptible to a path disclosure vulnerability that enables remote attackers to access sensitive information through direct HTTP requests. This flaw particularly involves the files search.info.php, permissions.info.php, security.info.php, formcontrol.php, and file_modules.php. When these files are accessed, they can reveal the server's file system paths within error messages due to an undefined pathos_core_version variable. This unintended information exposure can lead to further attacks or unauthorized access, underscoring the importance of promptly addressing this flaw.

References