CVE-2005-4214

Published: Dec 14, 2005Modified: Apr 16, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

phpCOIN 1.2.2 allows remote attackers to obtain the installation path via a direct request to config.php, which leaks the path in an error message because the _CCFG['_PKG_PATH_DBSE'] variable is not defined.

Affected (1)

Products: Coinsoft Technologies: Phpcoin

Coinsoft Technologies

1 product

Phpcoin

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Coinsoft Technologies Phpcoin	Version 1.2.2

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (16)

http://forums.phpcoin.com/index.php?showtopic=5469

Source: cve@mitre.org

http://rgod.altervista.org/phpcoin122.html

Source: cve@mitre.org

ExploitVendor Advisory

http://rgod.altervista.org/phpcoin_122_sql_xpl.html

Source: cve@mitre.org

Exploit

http://secunia.com/advisories/18030

Source: cve@mitre.org

Vendor Advisory

http://securitytracker.com/id?1015345

Source: cve@mitre.org

Exploit

http://www.osvdb.org/21726

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/419382/100/0/threaded

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2005/2888

Source: cve@mitre.org

Vendor Advisory

http://forums.phpcoin.com/index.php?showtopic=5469