BID:4612

PHP-Survey Global.INC Information Disclosure Vulnerability

Info

PHP-Survey Global.INC Information Disclosure Vulnerability

Bugtraq ID:	4612
Class:	Configuration Error
CVE:	CVE-2002-0614
Remote:	Yes
Local:	No
Published:	Apr 26 2002 12:00AM
Updated:	Jul 11 2009 12:46PM
Credit:	Discovery of this issue is credited to "MOD" <[email protected]>.
Vulnerable:	PHP-Survey PHP-Survey prebeta-20000327 - Apache Apache 1.3.24 - Apache Apache 1.3.23 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.18 PHP-Survey PHP-Survey 20000615 - Apache Apache 1.3.24 - Apache Apache 1.3.23 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.18 PHP-Survey PHP-Survey 20000614b - Apache Apache 1.3.24 - Apache Apache 1.3.23 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.18 PHP-Survey PHP-Survey 20000614 - Apache Apache 1.3.24 - Apache Apache 1.3.23 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.18 PHP-Survey PHP-Survey 20000421 - Apache Apache 1.3.24 - Apache Apache 1.3.23 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.18 PHP-Survey PHP-Survey 20000420 - Apache Apache 1.3.24 - Apache Apache 1.3.23 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.18

Not Vulnerable:

Discussion

PHP-Survey Global.INC Information Disclosure Vulnerability

PHP-Survey is a web-based survey engine. It is written in PHP and will run on most Unix and Linux variants. It is back-ended by a MySQL database.

The PHP-Survey script 'global.inc' will not be interpreted if requested via HTTP. This may potentially expose sensitive information such as database credentials to remote attackers.

Exploit / POC

PHP-Survey Global.INC Information Disclosure Vulnerability

This issue may be exploited with a web browser. The attacker simply makes a request for the 'global.inc' script.

Solution / Fix

PHP-Survey Global.INC Information Disclosure Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

References

PHP-Survey Global.INC Information Disclosure Vulnerability

References:

PHP-Survey Homepage (PHP-Survey)