Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (Generic)  >   phpSysInfo Vendors:
phpSysInfo Discloses Whether Files Exist to Remote Users
SecurityTracker Alert ID:  1016440
SecurityTracker URL:
CVE Reference:   CVE-2006-3360   (Links to External Site)
Updated:  Aug 7 2008
Original Entry Date:  Jul 5 2006
Impact:   Disclosure of system information
Exploit Included:  Yes  
Version(s): 2.5.1
Description:   A vulnerability was reported in phpSysInfo. A remote user can determine whether specified files exist on the target system.

A remote user can supply a specially crafted 'lng' parameter containing directory traversal characters and terminating with a null byte. The system returns a different error message depending on whether the specified file exists. A request for a file that exists will return:

"Sorry, we don't support this language."

A request for a file that does not exist will return the normal phpSysInfo application page.

A demonstration exploit URL is provided:


Micheal Turner reported this vulnerability.

Impact:   A remote user can determine whether specified files exist on the target system.
Solution:   No solution was available at the time of this entry.
Vendor URL: (Links to External Site)
Cause:   Access control error, State error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.

 Source Message Contents

Subject:  [Full-disclosure] phpSysInfo arbitrary file identification

phpSysInfo is a popular webscript for displaying stats
about a webserver available from with 365012
downloads to date. A vulnerability which allows an
attacker to identify if a file exists on the remote
system has been identified. By supplying a directory
traversal string to lng= in a POST or  GET request to
index.php with a poison null byte terminating %00
allows an attacker to determine if any file exists.
The vulnerable function is shown.

  if (!file_exists(APP_ROOT . '/includes/lang/' . $lng
. '.php')) {

An attacker can determine if the file exists by
studying the returned error message, valid files
phpSysInfo application page. 



Inbox full of spam? Get leading spam protection and 1GB storage with All New Yahoo! Mail.

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -


Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2022, LLC