CVE:CVE-2009-2329
CNNVD:CNNVD-200907-076
KerviNet Forum 1.1以及之前版本允许远程攻击者借助对
(1)admin/head.php
(2)voting_diagram.php
(3)voting.php 
(4)topics_search.php
(5)topics_list.php
(6)top_part.php
(7)quick_search.php
(8)quick_reply.php
(9)moder_menu.php
(10)messages_list.php
(11)menu.php
(12)head.php
(13)forums_list.php
(14)forum_statistics.php
(15)forum_info.php
(16)include_files/中的birthday.php
的一个直接请求获取敏感信息。该请求会以错误的消息显示安装路径。
solution:Upgrade max_kervin kervinet_forum to a higher version than 1.1,and avoid the version (,1.1]