[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-id: <45D0E15A.5000201@free.fr>
Date: Mon, 12 Feb 2007 22:51:22 +0100
From: Raphaƫl HUCK <raphael.huck@...e.fr>
To: Cedric Blancher <blancher@...tel-securite.fr>
Cc: bugtraq@...urityfocus.com
Subject: Re: DotClear Full Path Disclosure Vulnerability
I do agree with you, but I think in this case it is a DotClear issue.
The default themes provided with DotClear do not check that they have
been called by a regular DotClear page, and spit out useful information
for an attacker.
They should check that a certain variable is defined for example, and if
not, do not display anything... even if the hosted website is configured
to display errors, and you cannot change this.
>> Fatal error: Call to a member function fetch() on a non-object in
>> /home/users/xxxx/dotclear/themes/xxx/list.php on line 34
>
> Note it's not wise to display errors on a production website. However,
> when hosted, you don't necessarily have this choice...
>
>
Powered by blists - more mailing lists