HexBrain

Localize · Report #7888

Unexpected array leaks information about the system

Validstatus
4upvotes
18 Apr 2014disclosed

How it was found

By changing a string parameter on the /pages/settings page to an array (see example.png) and submitting the form, the page shows an error message leaking information about the server and functions used (see error.png). This works on multiple POST parameters.

Warning: trim() expects parameter 1 to be string, array given in /var/www/vhosts/lvps178-77-99-228.dedicated.hosteurope.de/httpdocs_localize/index.php on line 85

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original