----------------------------------------------------------------
TestLink <= 1.9.12 (database.class.php) Path Disclosure Weakness
----------------------------------------------------------------
[-] Software Link:
http://testlink.org/
[-] Affected Versions:
Version 1.9.12 and prior versions.
[-] Weakness Description:
The vulnerable code is located in the /lib/functions/database.class.php script:
208. if(defined('DBUG_ON') && DBUG_ON == 1)
209. {
210. echo "<pre>"; debug_print_backtrace(); echo "</pre>";
211. }
212. else
213. {
214. echo "<pre>"; debug_print_backtrace(DEBUG_BACKTRACE_IGNORE_ARGS); echo "</pre>";
215. }
The weakness exists due to this script reveals debug information generated by the "debug_print_backtrace()" function.
This can be exploited to gain knowledge of the web root directory by sending direct requests to certain scripts.
[-] Solution:
Update to version 1.9.13 when will be released or apply these hotfixes: http://mantis.testlink.org/view.php?id=6609
[-] Disclosure Timeline:
[06/10/2014] - Issue reported to http://mantis.testlink.org/view.php?id=6651
[07/10/2014] - Issue fixed in the Git repository: http://goo.gl/AnOAi6
[08/10/2014] - CVE number requested
[11/10/2014] - CVE number assigned
[23/10/2014] - Public disclosure
[-] CVE Reference:
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2014-8082 to this weakness.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Original Advisory:
http://karmainsecurity.com/KIS-2014-12
