PHPay PHPinfo.PHP Information Disclosure Weakness

Bugtraq ID:	7313
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 09 2003 12:00AM
Updated:	Apr 09 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to Ahmet Sabri ALPER <[email protected]>.
Vulnerable:	phPay phPay 2.2
Not Vulnerable:	phPay phPay 2.2.1

PHPay PHPinfo.PHP Information Disclosure Weakness

phPay has been reported vulnerable to an information disclosure weakness.

It has been reported that an attacker may view phPay administration pages without proper authentication. This action may result in the disclosure of information regarding the affected server.

The information gathered in this way may be harnessed to aid the attacker in further malicious activity directed towards the victim server.

While this vulnerability has been reported to affect phPay version 2.02, previous versions may also be affected.

PHPay PHPinfo.PHP Information Disclosure Weakness

There is no exploit required.

PHPay PHPinfo.PHP Information Disclosure Weakness

Solution:
This issue has been reported fixed in the current version of the software, users are advised to upgrade.


phPay phPay 2.2

• phPay phPay 2.02.1
  http://sourceforge.net/project/showfiles.php?group_id=39285

PHPay PHPinfo.PHP Information Disclosure Weakness

References:

• phPay Homepage (phPay)
  
• [ARL03-A16] Multiple Security Issues in phPay (Ahmet Sabri ALPER )