Possible Security Issue

[muchos]

Using Acunetix I ran a security check on my site and it picked up quite a few potential issues...

 

Firstly the lack of SSL brings up a possible interception exploit (which I've sorted with an SSL certificate) (Which I know is not a script problem)

 

But the issue that worried me was that the software picked up some High alert security issues (the highest out of 4 levels of warning).

 

With the error:

Script source code disclosure

 

Vulnerability description:

It is possible to read the source code of this script by using script filename as a parameter. It seems that this script includes a file which name is determined using user-supplied data. This data is not properly validated before being passed to the include function.

 

 

The impact of this vulnerability:

An attacker can gather sensitive information (database connection strings, application logic) by analysing the source code. This information can be used to launch further attacks.

 

Attack details:

The Cookie variable PHPSESSID has been set to announcements.php

 

How to fix this vulnerability:

Analyse the source code of this script and solve the problem.

 

Web references:

iMPERVA Source Code Disclosure

 

\/\/ \/\/ \/\/.imperva.com/application_defense_center/glossary/source_code_disclosure.html

 

For the following pages:

 

- announcements.php

- downloads.php

- knowledgebase.php

- serverstatus.php

- index.php

 

Still running search, so if any more docs are affected will update you

 

- Mutasim

[trine]

This may be a false positive. Did you try the test by yourself and did it produce the resulting output?

[muchos]

I ran the scan myself on my own site if that is what you where asking...

 

I didn't try and exploit the found errors because I don't know how

[Matt]

Security issue? All it's doing is pointing out the obvious. If someone reads your configuration.php file, they see your database connection details. It's the same with any script. To do that though, they need access to your server, and if they have that, they wouldn't need to be checking a file for the login details to it.

 

Matt

[muchos]

Thanks for clearing that up, the software is a bit oversensitive IMHO

[xTiNcTion]

Hi mutasim,

 

if you have root access i recomend you disable the following function (php.ini)

exec, shell_exec, system, passthru,popen, virtual, show_source, pclose