HexBrain

Localize · Report #8013

Full Path Disclosure (2)

Validstatus
3upvotes
19 Apr 2014disclosed

How it was found

During the import of an XML file,I edited the "file" to "url" for importing XML's through URL.So it became:

<input id="importFileXML" class="form-control" type="url" name="importFileXML"></input>

And then I tried to import a random XML file.I tried with this: http://www.swarthmore.edu/libraries.xml It was not a valid XML file.And after the importing it showed the following error which discloses full path of the application.

Notice: Undefined index: importFileXML in /var/www/vhosts/lvps178-77-99-228.dedicated.hosteurope.de/httpdocs_localize/index.php on line 421 

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original