CVE-2006-2329 Information

Description

AngelineCMS 0.6.5 and earlier allow remote attackers to obtain sensitive information via a direct request for (1) adodb-access.inc.php (2) adodb-ado.inc.php (3) adodb-ado_access.inc (4) adodb-ado_mssql.inc.php (5) adodb-borland_ibase (6) adodb-csv.inc.php (7) adodb-db2.inc.php (8) adodb-fbsql.inc.php (9) adodb-firebird.inc.php (10) adodb-ibase.inc.php (11) adodb-informix.inc.php (12) adodb-informix72.inc (13) adodb-mssql.inc.php (14) adodb-mssqlpo.inc.php (15) adodb-mysql.inc.php (16) adodb-mysqlt.inc.php (17) adodb-oci8.inc.php (18) adodb-oci805.inc.php (19) adodb-oci8po.inc.php and (20) adodb-odbc.inc.php which reveal the path in various error messages; and via a direct request for the (21) lib/system/ directory and (22) possibly other lib/ directories which provide a directory listing and \architecture view.\

Reference

http://securityreason.com/securityalert/883 http://www.securityfocus.com/archive/1/433241/100/0/threaded http://www.subjectzero.net/research/ang_CMS.htm https://exchange.xforce.ibmcloud.com/vulnerabilities/26383