Executive brief
A vulnerability exists in the mlog script, a component used in early PHP-based web environments. An attacker can exploit this flaw to view any file stored on the web server, including sensitive configuration files or system data. This could lead to the exposure of private information and provide a foothold for further attacks on the organization's infrastructure.
Technical details
The mlog script, running as a CGI application in PHP environments, fails to properly validate user-supplied input used in file path operations. This results in an arbitrary file disclosure vulnerability, likely via path traversal or direct parameter manipulation. A remote, unauthenticated attacker can exploit this by sending a specially crafted HTTP request to the mlog script, specifying the path of a file they wish to retrieve. Successful exploitation allows the attacker to read any file that the web server process has permissions to access, such as /etc/passwd or application source code.
Affected products
- PHP mlog script
Timeline
- 1997-10-16: disclosed: NVD Published Date