advisory0032 · CVE-2007-3127 · published 2007-06-17

WSPortal version 1.0 Path Disclosure Vulnerability

archived risk: low

Current status

This advisory describes a vulnerability from 2007. It is not in the CISA Known Exploited Vulnerabilities catalog and there is no active remediation deadline. The page is kept online because other security databases link to it.

CVE reference CVE-2007-3127
In KEV catalog no
Affected software WSPortal version 1.0
Captured from netvigilance.com

Original document

Reproduced as it was published, including the advisory numbering, scoring and the disclosure timeline used at the time.

converted from html as published 2007-06-17

Description:

WSPortal is a site management system coded in PHP/MySQL. It is capable of adding pages, adding news to pages, adding images to news articles, alerting the site or a specific ip address, private messaging system between administrators.

Successful exploitation requires PHP magic_quotes_gpc set to OFF.

External References:
Mitre CVE: CVE-2007-3127
NVD NIST: CVE-2007-3127
OSVDB: 34164

Summary:
WSPortal is a site management system coded in PHP/MySQL.
Security problem in the product allows attackers to gather the true path of the server-side script.

Release Date:
June 17 2007

Severity:
Risk: Low

CVSS Metrics:
Access Vector: Remote
Access Complexity: Low
Authentication: Not-required
Confidentiality Impact: Partial
Integrity Impact: None
Availability Impact: None
Impact Bias: Normal
CVSS Base Score: 2.3

Target Distribution on Internet: Low

Exploitability: Functional Exploit
Remediation Level: Workaround
Report Confidence: Uncorroborated

Vulnerability Impact: Attack
Host Impact: Path disclosure.

SecureScout Testcase ID:
TC 17962

Vulnerable Systems:
WSPortal version 1.0

Vulnerability Type:
Program flaws - The product scripts have flaws which lead to Warnings or even Fatal Errors.

Vendor:
Chris Harvey

Vendor Status:
The Vendor has been notified several times on many different email addresses last on 6 June 2007. The Vendor has not responded. There is no official fix at the release of this Security Advisory.

Workaround:
Set display_errors = Off (php.ini file) or set magic_quotes_gpc = On (php.ini file).

Example:

REQUEST:
http://[TARGET]/[WSPORTAL-DIRECTORY]/content.php?page=';

REPLY:
<b>Warning</b>: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in <b>[DISCLOSED PATH][WSPORTAL-DIRECTORY]\content.php</b> on line <b>67</b><br /> <b>Warning</b>: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in <b>[DISCLOSED PATH][WSPORTAL-DIRECTORY]\content.php</b> on line <b>76</b><br />

Credits:
Jesper Jurcenoks
Co-founder netVigilance, Inc
www.netvigilance.com

Original URL: /advisory0032.html · preserved at the same address

Why this page still exists

Advisories published between 2004 and 2015 are referenced by vulnerability databases, academic papers and mailing list archives. Removing them would break those references, so every advisory keeps its original address and its original text. Nothing on this page has been rewritten to match current practice.