http://www.swp-zone.org/archivos/advisory-08.txt

---------------------------------------------------------------------------=
----------------------

:.: Full path disclosure csFAQ :.:=20

PROGRAM: csFAQ
HOMEPAGE: http://www.cgiscript.net/
BUG: Full path disclosure
DATE: 23/05/2004
AUTHOR: DarkBicho
web: http://www.darkbicho.tk
team: Security Wari Proyects <www.swp-zone.org>
Email: darkbicho@peru.com

---------------------------------------------------------------------------=
----------------------

1.- Affected software description:
------------------------------
csFAQ An automated system for displaying FAQs (frequently asked
questions) written by
CGI Scripts.

2.- Description:=20
------------
This vulnerability would allow a remote user to determine the full
path to the web root directory and other potentially sensitive
information.


:.: Examples:

http://www.attack.com/cgi-script/csF...DviewFAQ&data=
base=3D/.darkbicho


/www/attack/cgi-script/csFAQ//%2f%2edarkbicho
Content-type: text/html=20
Software error:
1 at csFAQ.cgi line 1117.

3.- SOLUTION:
=A8=A8=A8=A8=A8=A8=A8=A8
Vendors were contacted many weeks ago and plan to release a fixed
version soon.=20
Check the PHP-NUKE website for updates and official release details.=20

4.- Greetings:
---------

greetings to my Peruvian group swp, perunderforce and machado =20
"EL PISCO ES Y SERA PERUANO"

5.- Contact
-------

WEB: http://www.darkbicho.tk
EMAIL: darkbicho@peru.com
=20=20
---------------------------------------------------------------------------=
----------------------
___________ ____________=20
/ _____/ \ / \______ \=20=20=20
\____ \\ \/\/ /| ___/=20=20=20=20=
=20=20
/ \\ / | |=20=20=20=20=20=
=20=20=20
/_____ __ / \__/\ / |____|=20=20=20=20=20=
=20=20
\/ \/=20=20=20=20=20=20=20=20
Security Wari Projects=20
(c) 2002 - 2004
Made in Peru

----------------------------------------[ EOF=20=20=20
]----------------------------------------------
=A0=0D
=A0=A0=0D
=A0=A0=0D
DarkBicho =0D
Web: http://www.darkbicho.tk=0D
"Mi unico delito es ver lo que otros no pueden ver"=0D
=0D
---------------------- The End ----------------------=0D