CVE-2012-1614

Name of the Vulnerable Software and Affected Versions Coppermine Photo Gallery versions prior to 1.5.20

Description The issue allows remote attackers to obtain sensitive information via various invalid parameters to different scripts, which reveals the installation path in an error message. This can be achieved by making a direct request to "plugins/visiblehookpoints/index.php", or by providing an invalid page or cat parameter to "thumbnails.php", an invalid page parameter to "usermgr.php", or an invalid newer than or older than parameter to "search.inc.php".

Recommendations For Coppermine Photo Gallery versions prior to 1.5.20, update to version 1.5.20 or later to resolve the issue.