w-Agora (Web-Agora) allows remote attackers to obtain sensitive information via a request to rss.php with an invalid (1) site or (2) bn parameter (3) a certain value of the site parameter or (4) an empty value of the bn parameter; a request to index.php with a certain value of the (5) site or (6) sort parameter; (7) a request to profile.php with an empty value of the site parameter; or a request to search.php with (8) an empty value of the bn parameter or a certain value of the (9) pattern or (10) search_date parameter which reveal the path in various error messages probably related to variable type inconsistencies. NOTE: the bn parameter to index.php is already covered by CVE-2007-0606.1.