|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #17716 Webroot Disclosure in Error Output
Submitted: 2002-06-11 18:08 UTC Modified: 2002-06-11 18:55 UTC
Avg. Score:3.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: mattmurphy at kc dot rr dot com Assigned:
Status: Not a bug Package: Output Control
PHP Version: 4.2.1 OS: Win32
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
Block user comment
Status: Assign to:
Bug Type:
From: mattmurphy at kc dot rr dot com
New email:
PHP Version: OS:


 [2002-06-11 18:08 UTC] mattmurphy at kc dot rr dot com
PHP 4.2.1 Path Disclosure Bug

System Details:
  - Windows Me
  - PHP 4.2.1 as CGI on Xitami 2.49d
  - No modules

PHP 4.2.1 (possibly and probably others) can disclose path information in error output.  This is due to the fact that PHP discloses the full path of failing scripts.  For example, take the deliberately malformed "Error.php":

@if ($action == "error") {

This script produces the following output:

Parse error: parse error, unexpected T_IF in C:\INETPUB\WWWROOT\error.php on line 2

As you can see, this includes the path of the web root in the error data.  This is surplus information at best, and at worst, data that could aid an attack against the server.

While this script produces a parse error, it should be noted that default installs of 4.2.1 produce this on such small events as notices as well.


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2002-06-11 18:25 UTC]
If you prefer security through obscurity you can put the following two lines in your php.ini:

 [2002-06-11 18:45 UTC] mattmurphy at kc dot rr dot com
Reading through php.ini, there are more security comments than lines of configuration, so I would think this would be a default not to error output to the user, at least.  I would be more satisfied if the path of the script were replaced with its name (such as switching "C:\INETPUB\WWWROOT\SOMESCRIPT.PHP" with simply "SOMESCRIPT.PHP", instead (at least in output error info; putting the path in logging would probably be okay).
 [2002-06-11 18:55 UTC]
And if cows could fly we wouldn't need any planes.
Just use the proposed ini options.
And ask further support questions elsewhere. 

Thank you for using PHP.

PHP Copyright © 2001-2023 The PHP Group
All rights reserved.
Last updated: Tue Mar 28 10:03:44 2023 UTC