Hello guys. I'm wondering about a potential vulnerability in a popular PHP framework I just ran across. While doing some testing, I found that I can force a server error which results in printing an error message that -usually- contains the database cleartext password. As far as I can see, this is reproducible, but I need to test more. Would that be considered a vulnerability in the PHP framework, or is it just developers doing a bad job at filtering printed out messages ?

@ack__ This is PHP we're talking about, so I would guess that is an undocumented feature. (Well, most likely ALL features are undocumented, but there ya go. )

:D right. But from my understanding, this is indeed a feature in the framework (might as well be documented, I have to check) - the "vulnerability" is that I can force that feature to execute and retrieve cleartext db password

it's sort of an "error message" printout function, very basic stuff, what I think is weird is that the default behavior is to print the pw just like that.. but maybe this is more on the developers side than the framework itself

@ack__ Is some sort of debug mode enabled?

@TerryChia Yes sort of. I think the feature is genuine, but the level of info is not OK. It should clean things before it prints - by default

It basically prints a database config file

which always include a cleartext pw

@ack__ The correct answer is disable debug mode before pushing to production. Everything else is just a waste of time.

@TerryChia Ok ,thank you ! Sad it's not included by default in the frameworks nowadays...

@ack__ normal frameworks, it is...

oh sorry, by "normal" I actually meant "sane"

@AviD :D I thought Symfony was "sane". Not as if it was widely used anyway..

@ack__ is it? I don't know, I'm not familiar, but I thought it was based on PHP

it's based on PHP yes, and very widely used as far as I know

i.e. not "sane"

:) well there are things in PHP that are sane

e.g. Django, except it's just not based on PHP.

Hi, I have a security related talk at college. Could you guys suggest demos that would be fun, engaging and get the audience (engineering students ages 18-24) interested in security?

taking a look!

@0x23212f Watch that video. Learn. Take inspiration from it shamelessly. I think Troy Hunt's Hack Yourself First sessions are some of the best introductory talks/demos I've seen.

seconded.