CVE:CVE-2005-2474
CNNVD:CNNVD-200508-054
ChurchInfo允许远程攻击者借助于提交到页面(1) PersonView.php， (2) MemberRoleChange.php， (3) PropertyAssign.php， (4) WhyCameEditor.php， (5) GroupPropsEditor.php， (6) Reports/PDFLabel.php或(7) UserDelete.php的PersonID参数，提交到页面(8) SelectList.php或(9) SelectDelete.php的无效Number参数，提交到页面(10) GroupView.php， (11) GroupMemberList.php， (12) MemberRoleChange.php， (13) GroupDelete.php， (14) /Reports/ClassAttendance.php或(15) /Reports/GroupReport.php的GroupID参数，提交到页面(16)PropertyEditor.php的PropertyID参数，提交到页面(17) Canvas05Editor.php， (18) CanvasEditor.php或(19) FamilyView.php的FamilyID参数，或提交到页面(20)PledgeDetails.php的PledgeID参数，获取敏感信息。这使得在错误信息中泄露了路径信息。
solution:Upgrade churchinfo churchinfo to a higher version than 1.1.1,1.1.2,1.1.3,1.1.4,1.1.5,1.1.6,1.2.0,1.2.1,1.2.2,and avoid the version 1.1.1,1.1.2,1.1.3,1.1.4,1.1.5,1.1.6,1.2.0,1.2.1,1.2.2