PHP 4.0 Bug #10091: -
| From: | megahz at the-megahz dot com | Date: | Sat, 31 Mar 2001 14:35:34 +0000 |
| Subject: | PHP 4.0 Bug #10091: - | ||
| Groups: | php.dev | ||
| Request: | Send a blank email to php-dev+get-50417@lists.php.net to get a copy of this message | ||
From: megahz@the-megahz.com
Operating system: -
PHP version: 4.0.4pl1
PHP Bug Type: *General Issues
Bug description: -
at the bugtraq yesterday:
I've found a bug in php/MySQL that can show u the webroot path.
If u ask a non-existent file:
http://xxx.xxx.xxx.xxx/comments.php?file=.3425
server's answer is:
Warning: 0 is not a MySQL result index in /www/lc/linstart/www/other_languages/german/comments.php
on line 74
I don't know if it's xploitable, I dont'know MySQL.
Let's xploit it!!
Darko
--------------
But this:
This will only happen if you have NOT turned off the error reporting in the
php.ini file. If you turn it off, and log the errors to a file you will not
get this.
--
Edit Bug report at: http://bugs.php.net/?id=10091&edit=1