CVEブラウザに戻る

CVE-2011-3700

MEDIUM

5.0

CVSS Severity Score

EPSS Score0.0910%

EPSS Percentile44.46th

Published2011年9月23日

Last Modified2026年4月29日

Vulnerability Description

Advanced Electron Forum (AEF) 1.0.8 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by languages/english/deletetopic_lang.php.

Affected Platforms (CPE)

📦

Anelectron

Advanced Electron Forum

= 1.0.8

References & Advisories

🔗 http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README

🔗 http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/aef-1.0.8

🔗 http://www.openwall.com/lists/oss-security/2011/06/27/6

🔗 http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README

🔗 http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/aef-1.0.8

🔗 http://www.openwall.com/lists/oss-security/2011/06/27/6

関連する脆弱性情報

CVE-2008-509010.0

Electron Inc. Advanced Electron Forum before 1.0.7 allows remote attackers to execute arbitrary PHP code via PHP code embedded in ...

CVE-2011-35828.8

A Cross-site Request Forgery (CSRF) vulnerability exists in Advanced Electron Forums (AEF) through 1.0.9 due to inadequate confirm...

CVE-2009-25456.8

SQL injection vulnerability in Advanced Electron Forum (AEF) 1.x, when magic_quotes_gpc is disabled, allows remote attackers to ex...

CVE-2018-130004.8

An XSS issue was discovered in Advanced Electron Forum (AEF) v1.0.9. A persistent XSS vulnerability is located in the `FTP Link` e...