CuteNews Debug Query Information Disclosure Weakness

Bugtraq ID:	9130
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 01 2003 12:00AM
Updated:	Dec 01 2003 12:00AM
Credit:	This weakness was reported by scrap <[email protected]>.
Vulnerable:	CutePHP CuteNews 1.3
Not Vulnerable:

CuteNews Debug Query Information Disclosure Weakness

An information disclosure weakness has been reported in CuteNews 1.3, that may expose sensitive server configuration data. The problem occurs due to CuteNews accepting a debug query that will result in the exposure of information returned from a call to the phpinfo() function.

A malicious person could potentially use information harvested through the exploitation this type of issue to launch future attacks against a target system.

CuteNews Debug Query Information Disclosure Weakness

No exploit is required. The following proof of concept URI has been provided:

http://www.example.com/cutenews/index.php?debug

CuteNews Debug Query Information Disclosure Weakness

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

CuteNews Debug Query Information Disclosure Weakness

References:

• CuteNews Home Page (CutePHP)
  
• Cutenews 1.3 information disclosure (scrap )