Paragon Initiative Enterprises · Report #115337

Full Path Disclosure

Validstatus

1upvotes

9 Mar 2016disclosed

How it was found

as reported in email, there is a full path disclosure in EasyDB

you fixed some of them in last commit add this code before and "execute($params)" function call!

if(count($params) != count($params,COUNT_RECURSIVE)){
            throw new \InvalidArgumentException("Invalid params");
}

this will check $params to be 1d array,

Regards

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original