Phpclanwebsite contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a remote attacker who is logged in as a clan administrator assigns a backslash to an the "page" variable, which will disclose the software's installation path in an error message, resulting in a loss of confidentiality. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.

Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround: add the following code to the end of the config.php file:

ini_set('display_errors', false)

• Bugtraq ID: 16391
• Secunia Advisory ID: 18597
• CVE ID: 2006-0445 (see also: NVD)
• Related OSVDB ID: 22720 22722
• Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-01/0422.html
• Other Advisory URL: http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt
• Vendor URL: http://www.phpclanwebsite.com/
• Vendor Specific Solution URL: http://www.phpclanwebsite.com/index.php?page=downloads&func=dl_file&par=175&cookie=true
• Keyword: HYSA-2006-002 h4cky0u.org Advisory 011

• matrix_killer - matrix_kabv.bg -