TestLink <= 1.9.12 (database.class.php) Path Disclosure Weakness

• Software Link:

• Affected Versions:

Version 1.9.12 and prior versions.

• Weakness Description:

The vulnerable code is located in the /lib/functions/database.class.php script:

208if(defined('DBUG_ON') && DBUG_ON == 1)
209{ 
210  echo "<pre>"; debug_print_backtrace(); echo "</pre>";
211}   
212else
213{
214  echo "<pre>"; debug_print_backtrace(DEBUG_BACKTRACE_IGNORE_ARGS); echo "</pre>";
215}

The weakness exists due to this script reveals debug information generated by the debug_print_backtrace() PHP function. This can be exploited to gain knowledge of the web root directory by sending direct requests to certain scripts.

• Solution:

Update to version 1.9.13 when will be released or apply these hotfixes: http://mantis.testlink.org/view.php?id=6609

• Disclosure Timeline:

[06/10/2014] – Issue reported to http://mantis.testlink.org/view.php?id=6651

[07/10/2014] – Issue fixed in the Git repository: http://goo.gl/AnOAi6

[08/10/2014] – CVE number requested

[11/10/2014] – CVE number assigned

[23/10/2014] – Public disclosure

• CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2014-8082 to this weakness.

• Credits:

Weakness discovered by Egidio Romano.