CVE:CVE-2008-7154
CNNVD:CNNVD-200909-028
Docebo 3.5.0.3及之前版本允许远程攻击者借助一个对doceboCore/中的(1)class/class.conf_fw.php,(2)class.module/class.event_manager.php, (3)lib/lib.domxml5.php或(4) menu/menu_over.php以及doceboCms/中的(5)class/class.conf_cms.php,(6)lib/lib.compose.php,(7) modules/chat/teleskill.php或(8)class/class.admin_menu_cms.php的直接请求，获得敏感信息。该请求会在出错信息中显示安装路径。
solution:Upgrade docebo docebo to a higher version than 3.5.0.3,3.0.3,3.0.4,3.0.5,3.5_beta,and avoid the version (,3.5.0.3],3.0.3,3.0.4,3.0.5,3.5_beta