Thepeak Index.PHP Source Code Information Disclosure Vulnerability

Bugtraq ID:	20760
Class:	Environment Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 26 2006 12:00AM
Updated:	Oct 27 2006 06:38PM
Credit:	Pham Duc Hai is credited with the discovery of this vulnerability.
Vulnerable:	Thepeak Thepeak File Upload 1.3
Not Vulnerable:

Thepeak Index.PHP Source Code Information Disclosure Vulnerability

The 'thepeak' application is prone to an information-disclosure vulnerability because it fails to properly handle exceptional conditions.

An attacker can exploit this issue to retrieve script source code. Information obtained may aid in further attacks.

Version 1.3 is vulnerable to this issue; other versions may also be affected.

Thepeak Index.PHP Source Code Information Disclosure Vulnerability

Attackers can exploit this issue via a web client.

The following proof-of-concept URI is available:

• /data/vulnerabilities/exploits/apache-aug9-2006.html

Thepeak Index.PHP Source Code Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

Thepeak Index.PHP Source Code Information Disclosure Vulnerability

References:

• Thepeak Web Site (Thepeak)
  
• Thepeak File Upload v1.3 : Read file vulneability ([email protected])