[Full-disclosure] cryptographp v1.4: file contents disclosure bug

[Jan G.B.]

Cryptographp - a `free` captcha script

I contacted the author on 2009-02-11 via e-mail but I did not get a response.
I feel the need users of that script should be aware of such a bug.

The main include of that script has the following PHP code:

#####
if (is_file($_GET['cfg']) and dirname($_GET['cfg'])=='.' )
$_SESSION['configfile']=$_GET['cfg'];
  else  $_SESSION['configfile']="cryptographp.cfg.php";

include($_SESSION['configfile']):
#####

This enables an attacker to output any file in the current directory,
where cryptographp has been installed.
For example you can read .ht* files like .htpasswd, .htaccess


Vulnerable: Latest Version 1.4 (did not check below)