HackerOne · Report #439174

Verbose PHP error messages exposed on a blog article

Validstatus

11upvotes

10 Apr 2019disclosed

How it was found

Hey guys!

For what its worth, warning messages aren't suppressed on the /blog/ endpoint, giving verbose PHP error messages when visiting a blog article such as https://www.hackerone.com/blog/H1-702-2018-makes-history-over-500K-bounties-paid.

{F374066}

Not much impact, just disclosures of paths and technologies used (Drupal, Symphony)

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original