Phpclanwebsite uploader.php Path Disclosure

2006-01-25T16:43:00
ID OSVDB:22721
Type osvdb
Reporter matrix_killer(matrix_k@abv.bg)
Modified 2006-01-25T16:43:00

Description

Vulnerability Description

Phpclanwebsite contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a remote attacker who is logged in as a clan administrator assigns a backslash to an the "page" variable, which will disclose the software's installation path in an error message, resulting in a loss of confidentiality. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.

Solution Description

Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround: add the following code to the end of the config.php file:

ini_set('display_errors', false)

Short Description

Phpclanwebsite contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a remote attacker who is logged in as a clan administrator assigns a backslash to an the "page" variable, which will disclose the software's installation path in an error message, resulting in a loss of confidentiality. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.

References:

Vendor URL: http://www.phpclanwebsite.com/ Vendor Specific Solution URL: http://www.phpclanwebsite.com/index.php?page=downloads&func=dl_file&par=175&cookie=true Secunia Advisory ID:18597 Related OSVDB ID: 22722 Related OSVDB ID: 22720 Other Advisory URL: http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-01/0422.html Keyword: HYSA-2006-002 h4cky0u.org Advisory 011 CVE-2006-0445 Bugtraq ID: 16391