full-disclosure - [SCSA-011] Path Disclosure Vulnerability in XOOPS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <005301c2ee61$eb1ab670$0300a8c0@goliath>
From: gregory.lebras at security-corporation.com (Gregory Le Bras | Security Corporation)
Subject: [SCSA-011] Path Disclosure Vulnerability in XOOPS

Security Corporation Security Advisory [SCSA-011]
________________________________________________________________________

PROGRAM: XOOPS
HOMEPAGE: http://www.xoops.org/
VULNERABLE VERSIONS: v2.0 (and prior ?)
________________________________________________________________________

DESCRIPTION
________________________________________________________________________

XOOPS is "a dynamic OO (Object Oriented) based open source portal script
written in PHP. XOOPS is the ideal tool for developing small to large
dynamic community websites,intra company portals, corporate portals,
weblogs and much more." (direct quote from XOOPS website)


DETAILS & EXPLOITS
________________________________________________________________________

? Details Path Disclosure :

A vulnerability have been found in XOOPS which allow attackers to determine
the physical path of the application.

This vulnerability would allow a remote user to determine the full path to
the web root directory and other potentially sensitive information.
This vulnerability can be triggered by a remote user submitting a
specially crafted HTTP request including invalid input to the
"$xoopsOption" variable.

? Exploits Path Disclosure :

http://[target]/index.php?xoopsOption=any_word

Affected files:
admin.php
edituser.php
footer.php
header.php
image.php
lostpass.php
pmlite.php
readpmsg.php
register.php
search.php
user.php
userinfo.php
viewpmsg.php
class/xoopsblock.php
modules/contact/index.php
modules/mydownloads/index.php
modules/mydownloads/brokenfile.php
modules/mydownloads/modfile.php
modules/mydownloads/ratefile.php
modules/mydownloads/singlefile.php
modules/mydownloads/submit.php
modules/mydownloads/topten.php
modules/mydownloads/viewcat.php
modules/mylinks/brokenlink.php
modules/mylinks/index.php
modules/mylinks/modlink.php
modules/mylinks/ratelink.php
modules/mylinks/singlelink.php
modules/mylinks/submit.php
modules/mylinks/topten.php
modules/mylinks/viewcat.php
modules/newbb/index.php
modules/newbb/search.php
modules/newbb/viewforum.php
modules/newbb/viewtopic.php
modules/news/archive.php
modules/news/article.php
modules/news/index.php
modules/sections/index.php
modules/system/admin.php
modules/xoopsfaq/index.php
modules/xoopsheadlines/index.php
modules/xoopsmembers/index.php
modules/xoopspartners/index.php
modules/xoopspartners/join.php
modules/xoopspoll/index.php
modules/xoopspoll/pollresults.php

SOLUTIONS
________________________________________________________________________

No solution for the moment.


VENDOR STATUS
________________________________________________________________________

The vendor has reportedly been notified.


LINKS
________________________________________________________________________

Version Fran?aise :
http://www.security-corporation.com/index.php?id=advisories&a=011-FR


------------------------------------------------------------------------
Gr?gory Le Bras aka GaLiaRePt | http://www.Security-Corporation.com
------------------------------------------------------------------------