Bug #68726 [NEW]: Full Path Disclosure Vulnerability

From: muratyilmazlar1 at gmail dot com Operating system: Windows, Linux PHP version: Irrelevant Package: MySQL related Bug Type: Bug Bug description:Full Path Disclosure Vulnerability Description: ------------ Although in itself does not lead to a real risk of attack, it allows you to go back to the internal structure of a server via a website and then to have more information to be used in case of pentesting, putting at risk not only the safety of the site but around the server that supplies. Test script: --------------- Here is the official website: http://faq.phpmyfaq.de/cron.verifyurls.php version: 2.8.12 https://joker.com/faq/cron.verifyurls.php version: 2.7.7 Expected result: ---------------- You can reach full path of website and server. Actual result: -------------- It could help hackers to hack site and sniffing. -- Edit bug report at https://bugs.php.net/bug.php?id=68726&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=68726&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=68726&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=68726&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=68726&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=68726&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=68726&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=68726&r=needscript Try newer version: https://bugs.php.net/fix.php?id=68726&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=68726&r=support Expected behavior: https://bugs.php.net/fix.php?id=68726&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=68726&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=68726&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=68726&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=68726&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=68726&r=dst IIS Stability: https://bugs.php.net/fix.php?id=68726&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=68726&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=68726&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=68726&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=68726&r=mysqlcfg