[25287] in bugtraq
PHP-Survey Database Access Vulnerability
daemon@ATHENA.MIT.EDU (MOD)
Fri Apr 26 18:18:43 2002
Message-ID: <000d01c1ed60$cd6b5010$b464c250@MATRIXHASYOU>
From: "MOD" <br014c1155@blueyonder.co.uk>
To: <bugtraq@securityfocus.com>
Date: Fri, 26 Apr 2002 21:27:34 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
PHP-Survey is an online survey creation and management system written in
PHP. It uses a MySQL database on backend for all data handling.
Global.inc holds the database information, and settings for the survey's
interface. Global.inc on default settings is not interpreted by PHP hence
any user can make an HTTP request for global.inc and will be able to view
the source code, hence the database password, username, localhost is
revealed, and also superuser information for the administration of the poll
survey. A solution might be to rename global.inc to global.inc.php.
