Gossamer Threads DBMan 2.0.4 - DBMan Information Leakage

Author: Black Watch Labs
type: remote
platform: multiple
port: 
date_added: 2000-05-05 
date_updated: 2012-07-17 
verified: 1 
codes: CVE-2000-0381;OSVDB-306 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/1178/info

Requesting an invalid database file from a web server implementing Gossamer Threads DBMan scripts will return a CGI error message containing environmental variables to a remote user without any authorization. The parameters displayed include the local document root path, server administrator account name, web server software, platform, etc.

http://target/scripts/dbman/db.cgi?db=invalid-db