|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #17716 Webroot Disclosure in Error Output
Submitted: 2002-06-11 18:08 UTC Modified: 2002-06-11 18:55 UTC
Avg. Score:3.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: mattmurphy at kc dot rr dot com Assigned:
Status: Not a bug Package: Output Control
PHP Version: 4.2.1 OS: Win32
Private report: No CVE-ID: None
 [2002-06-11 18:08 UTC] mattmurphy at kc dot rr dot com
PHP 4.2.1 Path Disclosure Bug

System Details:
  - Windows Me
  - PHP 4.2.1 as CGI on Xitami 2.49d
  - No modules

PHP 4.2.1 (possibly and probably others) can disclose path information in error output.  This is due to the fact that PHP discloses the full path of failing scripts.  For example, take the deliberately malformed "Error.php":

@if ($action == "error") {

This script produces the following output:

Parse error: parse error, unexpected T_IF in C:\INETPUB\WWWROOT\error.php on line 2

As you can see, this includes the path of the web root in the error data.  This is surplus information at best, and at worst, data that could aid an attack against the server.

While this script produces a parse error, it should be noted that default installs of 4.2.1 produce this on such small events as notices as well.


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2002-06-11 18:25 UTC]
If you prefer security through obscurity you can put the following two lines in your php.ini:

 [2002-06-11 18:45 UTC] mattmurphy at kc dot rr dot com
Reading through php.ini, there are more security comments than lines of configuration, so I would think this would be a default not to error output to the user, at least.  I would be more satisfied if the path of the script were replaced with its name (such as switching "C:\INETPUB\WWWROOT\SOMESCRIPT.PHP" with simply "SOMESCRIPT.PHP", instead (at least in output error info; putting the path in logging would probably be okay).
 [2002-06-11 18:55 UTC]
And if cows could fly we wouldn't need any planes.
Just use the proposed ini options.
And ask further support questions elsewhere. 

Thank you for using PHP.

PHP Copyright © 2001-2023 The PHP Group
All rights reserved.
Last updated: Fri Mar 31 20:03:38 2023 UTC