Paragon Initiative Enterprises · Report #119494
Full Path Disclosure In EasyDB
Informativestatus
16 Oct 2017disclosed
How it was found
Hi,
as reported in #115337 about a full path disclosure in EasyDB
you fixed some of them in last commits
but single function is vulnerable too and not fixed yet!
if(count($params) != count($params,COUNT_RECURSIVE)){
throw new \InvalidArgumentException("Invalid params");
}
this will check $params to be 1d array, add this code before line 366 in EasyDB.php
Regards