当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:
漏洞标题:
PHP官方多个分站存在git信息泄露可读取大量程序源码
相关厂商:
PHP
漏洞作者:
提交时间:
2015-06-18 11:00
修复时间:
2015-06-23 11:02
公开时间:
2015-06-23 11:02
漏洞类型:
敏感信息泄露
危害等级:
自评Rank:
20
漏洞状态:
漏洞已经通知厂商但是厂商忽略漏洞
漏洞来源:
http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]
Tags标签:
分享漏洞:
4人收藏 收藏
分享漏洞:

>

漏洞详情

披露状态:

2015-06-18: 细节已通知厂商并且等待厂商处理中
2015-06-23: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

PHP官方多个分站存在git信息泄露可读取大量程序源码

详细说明:

GIT打包

http://preview.php.net/.git/config
http://hk.php.net/.git/config
http://shared.php.net/.git/config
http://br.php.net/.git/config
http://br1.php.net/.git/config
http://br2.php.net/.git/config
http://master.php.net/.git/config
http://master.php.net/.git/config
http://mail.php.net/.git/config
http://qa.php.net/.git/config
http://qa.php.net/.git/config
http://nc.php.net/.git/config
http://nc1.php.net/.git/config
http://bd.php.net/.git/config
http://bd1.php.net/.git/config
http://tw2.php.net/.git/config
http://mx.php.net/.git/config
http://lxr.php.net/.git/config
http://hk2.php.net/.git/config
http://mx1.php.net/.git/config
http://at1.php.net/.git/config
http://ua2.php.net/.git/config
http://ua.php.net/.git/config
http://pt2.php.net/.git/config
http://dk.php.net/.git/config
http://dk1.php.net/.git/config
http://id.php.net/.git/config
http://id1.php.net/.git/config
http://th.php.net/.git/config
http://jm2.php.net/.git/config
http://jm.php.net/.git/config
http://de.php.net/.git/config
http://de1.php.net/.git/config
http://se2.php.net/.git/config
http://is.php.net/.git/config
http://ca.php.net/.git/config
http://li.php.net/.git/config
http://pl1.php.net/.git/config
http://pl.php.net/.git/config
http://jp2.php.net/.git/config
http://ca1.php.net/.git/config
http://us2.php.net/.git/config
http://ca2.php.net/.git/config
http://es.php.net/.git/config
http://es1.php.net/.git/config
http://se.php.net/.git/config
http://it1.php.net/.git/config
http://is2.php.net/.git/config
http://bg.php.net/.git/config
http://bg2.php.net/.git/config
http://docs.php.net/.git/config
http://euk2.php.net/.git/config
http://md1.php.net/.git/config


案例:http://preview.php.net/.git/config

2015-06-18_100634.png


2015-06-18_100903.png


2015-06-18_100931.png


漏洞证明:

修复方案:

版权声明:转载请注明来源 渔村安全实验室@乌云


>

漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2015-06-23 11:02

厂商回复:

漏洞Rank:4 (WooYun评价)

最新状态:

暂无