bugtraq - WHMCS V3.7.1 Sensible Information Disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <200811262232.mAQMW9DI012163@www5.securityfocus.com>
Date: Wed, 26 Nov 2008 15:32:09 -0700
From: julianrdz91@...il.com
To: bugtraq@...urityfocus.com
Subject: WHMCS V3.7.1 Sensible Information Disclosure

Software: WHMCS V3.7.1
Complete Name: WHM Complete Solution Version 3.7.1
Bug: Information Disclosure

Website of the Software: http://www.whmcs.com/

Author: Julian A. Rodriguez
Contact: julianrdz91@...il.com

Review:

An attacker can obtain very sensible information about the server
just typing the next path : /status/index.php?action=phpinfo
You can enter to this folder/file without any kind of security test
or some authorization. You can get information about the versions
of the software, the kernel version, the operating system, the
commands that you can use inside the server, you can see if the
safe mode of the server is on/off, you can grab information
about the server administrator too, the path of the server root,
and a lot of more information about the server.

Proof of Concept:
http://www.xxxxxxxx.net/status/index.php?action=phpinfo

Note:
In the demo of the site whmcs.com you can't enter to this section because
the files have been deleted for security reasons.

--
Julian A. Rodriguez
Website: http://www.nulledcore.com