Andy's PHP Projects Man Page Lookup Script Information Disclosure Vulnerability

Bugtraq ID:	9395
Class:	Input Validation Error
CVE:	CVE-2004-0071
Remote:	Yes
Local:	No
Published:	Jan 10 2004 12:00AM
Updated:	Jul 12 2009 12:56AM
Credit:	Discovery credited to =?iso-8859-1?Q?Cabezon_Aur=E9lien?= <[email protected]>.
Vulnerable:	Andy's PHP Projects Man Page Lookup
Not Vulnerable:

Andy's PHP Projects Man Page Lookup Script Information Disclosure Vulnerability

A problem in the handling of user-supplied input by Andy's PHP Projects Man Page Lookup script has been reported. Because of this, it is possible for an attacker to gain unauthorized access to sensitive information on a system.

Andy's PHP Projects Man Page Lookup Script Information Disclosure Vulnerability

No exploit is required for this vulnerability.

The following proof-of-concept has been made available:

http://www.example.com/manpage/index.php?command=/etc/resolv.conf

Andy's PHP Projects Man Page Lookup Script Information Disclosure Vulnerability

Solution:
The vendor has provided an upgrade for this issue.


Andy's PHP Projects Man Page Lookup

• Andy's PHP Projects class.manpagelookup.php
  http://php.amnuts.com/index.php?do=fdload&id=1&file=class.manpagelooku p.php

Andy's PHP Projects Man Page Lookup Script Information Disclosure Vulnerability

References:

• Projects Homepage (Andy's PHP Projects)
  
• PHP Manpage lookup directory transversal / file disclosing (=?iso-8859-1?Q?Cabezon_Aur=E9lien?= )