Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:31355
HistoryNov 03, 2014 - 12:00 a.m.

[KIS-2014-12] TestLink <= 1.9.12 (database.class.php) Path Disclosure Weakness

2014-11-0300:00:00
vulners.com
27

TestLink <= 1.9.12 (database.class.php) Path Disclosure Weakness

[-] Software Link:

http://testlink.org/

[-] Affected Versions:

Version 1.9.12 and prior versions.

[-] Weakness Description:

The vulnerable code is located in the /lib/functions/database.class.php script:

  1.      if&#40;defined&#40;&#39;DBUG_ON&#39;&#41; &amp;&amp; DBUG_ON == 1&#41;
    
  2.      {
    
  3.        echo &quot;&lt;pre&gt;&quot;; debug_print_backtrace&#40;&#41;; echo &quot;&lt;/pre&gt;&quot;;
    
  4.      }
    
  5.      else
    
  6.      {
    
  7.        echo &quot;&lt;pre&gt;&quot;; debug_print_backtrace&#40;DEBUG_BACKTRACE_IGNORE_ARGS&#41;; echo &quot;&lt;/pre&gt;&quot;;
    
  8.      }
    

The weakness exists due to this script reveals debug information generated by the "debug_print_backtrace()" function.
This can be exploited to gain knowledge of the web root directory by sending direct requests to certain scripts.

[-] Solution:

Update to version 1.9.13 when will be released or apply these hotfixes: http://mantis.testlink.org/view.php?id=6609

[-] Disclosure Timeline:

[06/10/2014] - Issue reported to http://mantis.testlink.org/view.php?id=6651
[07/10/2014] - Issue fixed in the Git repository: http://goo.gl/AnOAi6
[08/10/2014] - CVE number requested
[11/10/2014] - CVE number assigned
[23/10/2014] - Public disclosure

[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2014-8082 to this weakness.

[-] Credits:

Vulnerability discovered by Egidio Romano.

[-] Original Advisory:

http://karmainsecurity.com/KIS-2014-12

Related for SECURITYVULNS:DOC:31355