pMachine Remote Path Disclosure Vulnerability
BID:7980
Info
pMachine Remote Path Disclosure Vulnerability
| Bugtraq ID: | 7980 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 19 2003 12:00AM |
| Updated: | Jun 19 2003 12:00AM |
| Credit: | This vulnerability was reported by "Lorenzo Hernandez Garcia-Hierro" <[email protected]>. |
| Vulnerable: |
PMachine PMachine 2.2.1 PMachine PMachine 2.2 PMachine PMachine 2.1 PMachine PMachine 2.0 PMachine PMachine 1.0 |
| Not Vulnerable: | |
Discussion
pMachine Remote Path Disclosure Vulnerability
It has been reported that pMachine is prone to remote a patch disclosure vulnerability when accessing various scripts.
When a request is made for a target PHP script, possibly requiring a blank URI parameter, pMachine is said to throw an exception. When this occurs, the resulting error page discloses the installation directory of the respective PHP script.
It has been reported that pMachine is prone to remote a patch disclosure vulnerability when accessing various scripts.
When a request is made for a target PHP script, possibly requiring a blank URI parameter, pMachine is said to throw an exception. When this occurs, the resulting error page discloses the installation directory of the respective PHP script.
Exploit / POC
pMachine Remote Path Disclosure Vulnerability
No exploit is required. The following proof of concept URLs have been provided.
http://www.example.com/Path_To_pMachine/index.php?sfx=
http://www.example.com/Path_To_pMachine/inc.lib.php?sfx=
http://www.example.com/Path_To_pMachine/inc.cp.php?sfx=
http://www.example.com/Path_To_pMachine/lib/weblog.add.php
http://www.example.com/Path_To_pMachine/lib/comment.add.php
No exploit is required. The following proof of concept URLs have been provided.
http://www.example.com/Path_To_pMachine/index.php?sfx=
http://www.example.com/Path_To_pMachine/inc.lib.php?sfx=
http://www.example.com/Path_To_pMachine/inc.cp.php?sfx=
http://www.example.com/Path_To_pMachine/lib/weblog.add.php
http://www.example.com/Path_To_pMachine/lib/comment.add.php
Solution / Fix
pMachine Remote Path Disclosure Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.