CVE-2012-4255 Information

Description

MySQLDumper 1.24.4 allows remote attackers to obtain sensitive information via a direct request to learn/cubemail/refresh_dblist.php which reveals the installation path in an error message.

Reference

http://packetstormsecurity.org/files/112304/MySQLDumper-1.24.4-LFI-XSS-CSRF-Code-Execution-Traversal.html http://www.osvdb.org/81616 http://www.securityfocus.com/bid/53306