bugtraq - Re: DotClear Full Path Disclosure Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 12 Feb 2007 22:51:22 +0100
From: Raphaël HUCK <raphael.huck@...e.fr>
To: Cedric Blancher <blancher@...tel-securite.fr>
Cc: bugtraq@...urityfocus.com
Subject: Re: DotClear Full Path Disclosure Vulnerability

I do agree with you, but I think in this case it is a DotClear issue.

The default themes provided with DotClear do not check that they have 
been called by a regular DotClear page, and spit out useful information 
for an attacker.

They should check that a certain variable is defined for example, and if 
not, do not display anything... even if the hosted website is configured 
to display errors, and you cannot change this.

>> Fatal error: Call to a member function fetch() on a non-object in
>> /home/users/xxxx/dotclear/themes/xxx/list.php on line 34
> 
> Note it's not wise to display errors on a production website. However,
> when hosted, you don't necessarily have this choice...
> 
>