Test case 17970
myBloggie 2.1.6 path disclosure, corresponding to CVE-2007-3650.
Vulnerability summary
myWebland myBloggie 2.1.6 allow remote attackers to obtain sensitive information via (1) an invalid year parameter to calendar.php, reached through index.php; (2) a direct request to common.php; and (3) a mode array parameter in the query string to login.php, which reveal the installation path in various error messages.
What this test case checks
myWebland myBloggie 2.1.6 leaks its installation path through three error paths: an invalid year parameter to calendar.php, a direct request to common.php, and a mode array parameter to login.php. Each triggers a PHP error message that includes the full filesystem path. Path disclosure on its own is low impact, but it makes other vulnerabilities easier to exploit reliably.