Test case 17971
FaName 1.0 path disclosure, corresponding to CVE-2007-3651.
Vulnerability summary
class/page.php in Farsi Script (aka FaScript) FaName 1.0 allows remote attackers to obtain sensitive information via a '; (quote semicolon) sequence in the id parameter, which reveals the installation path in an error message.
What this test case checks
Farsi Script FaName 1.0 leaks its installation path when class/page.php receives an id parameter containing a quote-semicolon sequence ("';"). The malformed value triggers a database error that the application echoes back to the user, including the full server path. As with other path-disclosure issues, the value is in chaining: it makes subsequent injection or include-based attacks predictable.