[Full-disclosure] cryptographp v1.4: file contents disclosure bug
ro0ot.w00t at googlemail.com
Sun Mar 15 13:56:16 GMT 2009
Cryptographp - a `free` captcha script
I contacted the author on 2009-02-11 via e-mail but I did not get a response.
I feel the need users of that script should be aware of such a bug.
The main include of that script has the following PHP code:
if (is_file($_GET['cfg']) and dirname($_GET['cfg'])=='.' )
This enables an attacker to output any file in the current directory,
where cryptographp has been installed.
For example you can read .ht* files like .htpasswd, .htaccess
Vulnerable: Latest Version 1.4 (did not check below)
Full-Disclosure is hosted and sponsored by Secunia.