[UNIX] Path Disclosure Bug in TOPo

From: support@securiteam.com
Date: 02/26/03

  • Next message: support@securiteam.com: "[NEWS] A new Mass-Mailing and Backdoor Capable Worm Found in the Wild" 
    From: support@securiteam.com
To: list@securiteam.com
Date: 26 Feb 2003 17:07:37 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    Beyond Security would like to welcome Tiscali World Online
    to our service provider team.
    For more info on their service offering IP-Secure,
    please visit http://www.worldonline.co.za/services/work_ip.asp
    - - - - - - - - -

      Path Disclosure Bug in TOPo
    ------------------------------------------------------------------------

    SUMMARY

     
    <http://ej3scripts.loadedweb.com/modules.php?name=Info_Scripts&file=index&func=topos a free TOP system written in PHP that works without a MySQL database. TOPo is specially designed for web sites hosted in web servers that do not offer a quality MySQL support.
    A vulnerability in the product allows attackers to reveal the true path of
    the PHP script files on the server.

    DETAILS

    Vulnerable versions:
     * TOPo Version 1.43 and below

    Immune Versions:
     * TOPo Version 2.0.081 and above.

    This vulenrability allows a user to read the full path to the in.php and
    out.php files' location.
    This is a security hazard, as it gives attackers restricted information
    about the structure of the hosting webserver.

    Example:
    http://host/[top_path]/in.php?
    http://host/[top_path]/out.php?
    http://host/[top_path]/in.php?id=any_word
    http://host/[top_path]/out.php?id=any_word
    http://host/[top_path]/in.php?any_word
    http://host/[top_path]/out.php?any_word

    The result will contain something like:
    Warning: mysql_num_rows(): supplied argument is not a valid MySQL result
    resource in /path/to/php/in.php on line 5 Warning ...

    Solution:
    Download the latest version from the site:
     
    <http://ej3scripts.loadedweb.com/modules.php?name=Downloads&d_op=viewdownloaddetails&lid=12&title=EJ3_TOPo_v2.0.090ion 2.0.90

    ADDITIONAL INFORMATION

    Information was provided by <http://www.RZWEB.com.ar> Xyborg

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

    Relevant Pages