A Local File Inclusion (LFI) vulnerability occurs when a file from the target system is injected into the attacked server page. Netsparker confirmed this issue by reading some files from the target web server.
Impact
Impact can differ based on the exploitation and the read permission of the web server user. Depending on these factors an attacker might carry out one or more of the following attacks:
Gather usernames via /etc/password file
Harvest useful information from the log files such as "/apache/logs/error.log" or "/apache/logs/access.log"
Remotely execute commands via combining this vulnerability with some of other attack vectors such as file upload vulnerability or log injection.
Remedy
If possible, do not accept appending file paths directly. Make it hard-coded or selectable from a limited hard-coded path list via an index variable
If you definitely need dynamic path concatenation, ensure that you only accept required characters such as "a-Z0-9" and do not allow "..", "/", "%00" (null byte) or any other similar unexpected characters.
Finally it is important to limit the API to allow inclusion only from a directory and directories below it. This way you can ensure that any potential attack can not perform a directory traversal attack.
Notice: Undefined index: old in /home/ibegin.com/public_html/weather/weather_widget.php on line 24Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64root:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/shsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/bin/shman:x:6:12:man:/var/cache/man:/bin/shlp:x:7:7:lp:/var/spool/lpd:/bin/shmail:x:8:8:mail:/var/mail:/bin/shnews:x:9:9:news:/var/spool/news:/bin/shuucp:x:10:10:uucp:/var/spool/uucp:/bin/shproxy:x:13:13:proxy:/bin:/bin/shwww-data:x:33:33:www-data:/var/www:/bin/shbackup:x:34:34:backup:/var/backups:/bin/shlist:x:38:38:Mailing List Manager:/var/list:/bin/shirc:x:39:39:ircd:/var/run/ircd:/bin/shgnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/shnobody:x:65534:65534:nobody:/nonexistent:/bin/shlibuuid:x:100:101::/var/lib/libuuid:/bin/shsyslog:x:101:103::/home/syslog:/bin/falsesshd:x:102:65534::/var/run/sshd:/usr/sbin/nologinjphilp:x:1000:1000:Jason Philp,,,:/home/jphilp:/bin/bashafarooq:x:1001:1001:Ahmed Farooq,,,:/home/afarooq:/bin/bashpostfix:x:103:106::/var/spool/postfix:/bin/falsedealwatch:x:1002:1003:,,,:/home/dealwatch:/bin/bash
Notice: Undefined index: old in /home/ibegin.com/public_html/weather/weather_widget.php on line 24Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64root:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/shsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/bin/shman:x:6:12:man:/var/cache/man:/bin/shlp:x:7:7:lp:/var/spool/lpd:/bin/shmail:x:8:8:mail:/var/mail:/bin/shnews:x:9:9:news:/var/spool/news:/bin/shuucp:x:10:10:uucp:/var/spool/uucp:/bin/shproxy:x:13:13:proxy:/bin:/bin/shwww-data:x:33:33:www-data:/var/www:/bin/shbackup:x:34:34:backup:/var/backups:/bin/shlist:x:38:38:Mailing List Manager:/var/list:/bin/shirc:x:39:39:ircd:/var/run/ircd:/bin/shgnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/shnobody:x:65534:65534:nobody:/nonexistent:/bin/shlibuuid:x:100:101::/var/lib/libuuid:/bin/shsyslog:x:101:103::/home/syslog:/bin/falsesshd:x:102:65534::/var/run/sshd:/usr/sbin/nologinjphilp:x:1000:1000:Jason Philp,,,:/home/jphilp:/bin/bashafarooq:x:1001:1001:Ahmed Farooq,,,:/home/afarooq:/bin/bashpostfix:x:103:106::/var/spool/postfix:/bin/falsedealwatch:x:1002:1003:,,,:/home/dealwatch:/bin/bash
Notice: Undefined index: old in /home/ibegin.com/public_html/weather/weather_widget.php on line 24Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64root:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/shsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/bin/shman:x:6:12:man:/var/cache/man:/bin/shlp:x:7:7:lp:/var/spool/lpd:/bin/shmail:x:8:8:mail:/var/mail:/bin/shnews:x:9:9:news:/var/spool/news:/bin/shuucp:x:10:10:uucp:/var/spool/uucp:/bin/shproxy:x:13:13:proxy:/bin:/bin/shwww-data:x:33:33:www-data:/var/www:/bin/shbackup:x:34:34:backup:/var/backups:/bin/shlist:x:38:38:Mailing List Manager:/var/list:/bin/shirc:x:39:39:ircd:/var/run/ircd:/bin/shgnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/shnobody:x:65534:65534:nobody:/nonexistent:/bin/shlibuuid:x:100:101::/var/lib/libuuid:/bin/shsyslog:x:101:103::/home/syslog:/bin/falsesshd:x:102:65534::/var/run/sshd:/usr/sbin/nologinjphilp:x:1000:1000:Jason Philp,,,:/home/jphilp:/bin/bashafarooq:x:1001:1001:Ahmed Farooq,,,:/home/afarooq:/bin/bashpostfix:x:103:106::/var/spool/postfix:/bin/falsedealwatch:x:1002:1003:,,,:/home/dealwatch:/bin/bash
Notice: Undefined index: old in /home/ibegin.com/public_html/weather/weather_widget.php on line 24Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64root:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/shsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/bin/shman:x:6:12:man:/var/cache/man:/bin/shlp:x:7:7:lp:/var/spool/lpd:/bin/shmail:x:8:8:mail:/var/mail:/bin/shnews:x:9:9:news:/var/spool/news:/bin/shuucp:x:10:10:uucp:/var/spool/uucp:/bin/shproxy:x:13:13:proxy:/bin:/bin/shwww-data:x:33:33:www-data:/var/www:/bin/shbackup:x:34:34:backup:/var/backups:/bin/shlist:x:38:38:Mailing List Manager:/var/list:/bin/shirc:x:39:39:ircd:/var/run/ircd:/bin/shgnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/shnobody:x:65534:65534:nobody:/nonexistent:/bin/shlibuuid:x:100:101::/var/lib/libuuid:/bin/shsyslog:x:101:103::/home/syslog:/bin/falsesshd:x:102:65534::/var/run/sshd:/usr/sbin/nologinjphilp:x:1000:1000:Jason Philp,,,:/home/jphilp:/bin/bashafarooq:x:1001:1001:Ahmed Farooq,,,:/home/afarooq:/bin/bashpostfix:x:103:106::/var/spool/postfix:/bin/falsedealwatch:x:1002:1003:,,,:/home/dealwatch:/bin/bash
Notice: Undefined index: old in /home/ibegin.com/public_html/weather/weather_widget.php on line 24Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64root:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/shsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/bin/shman:x:6:12:man:/var/cache/man:/bin/shlp:x:7:7:lp:/var/spool/lpd:/bin/shmail:x:8:8:mail:/var/mail:/bin/shnews:x:9:9:news:/var/spool/news:/bin/shuucp:x:10:10:uucp:/var/spool/uucp:/bin/shproxy:x:13:13:proxy:/bin:/bin/shwww-data:x:33:33:www-data:/var/www:/bin/shbackup:x:34:34:backup:/var/backups:/bin/shlist:x:38:38:Mailing List Manager:/var/list:/bin/shirc:x:39:39:ircd:/var/run/ircd:/bin/shgnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/shnobody:x:65534:65534:nobody:/nonexistent:/bin/shlibuuid:x:100:101::/var/lib/libuuid:/bin/shsyslog:x:101:103::/home/syslog:/bin/falsesshd:x:102:65534::/var/run/sshd:/usr/sbin/nologinjphilp:x:1000:1000:Jason Philp,,,:/home/jphilp:/bin/bashafarooq:x:1001:1001:Ahmed Farooq,,,:/home/afarooq:/bin/bashpostfix:x:103:106::/var/spool/postfix:/bin/falsedealwatch:x:1002:1003:,,,:/home/dealwatch:/bin/bash
Notice: Undefined index: old in /home/ibegin.com/public_html/weather/weather_widget.php on line 24Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64root:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/shsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/bin/shman:x:6:12:man:/var/cache/man:/bin/shlp:x:7:7:lp:/var/spool/lpd:/bin/shmail:x:8:8:mail:/var/mail:/bin/shnews:x:9:9:news:/var/spool/news:/bin/shuucp:x:10:10:uucp:/var/spool/uucp:/bin/shproxy:x:13:13:proxy:/bin:/bin/shwww-data:x:33:33:www-data:/var/www:/bin/shbackup:x:34:34:backup:/var/backups:/bin/shlist:x:38:38:Mailing List Manager:/var/list:/bin/shirc:x:39:39:ircd:/var/run/ircd:/bin/shgnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/shnobody:x:65534:65534:nobody:/nonexistent:/bin/shlibuuid:x:100:101::/var/lib/libuuid:/bin/shsyslog:x:101:103::/home/syslog:/bin/falsesshd:x:102:65534::/var/run/sshd:/usr/sbin/nologinjphilp:x:1000:1000:Jason Philp,,,:/home/jphilp:/bin/bashafarooq:x:1001:1001:Ahmed Farooq,,,:/home/afarooq:/bin/bashpostfix:x:103:106::/var/spool/postfix:/bin/falsedealwatch:x:1002:1003:,,,:/home/dealwatch:/bin/bash
Notice: Undefined index: old in /home/ibegin.com/public_html/weather/weather_widget.php on line 24Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64root:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/shsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/bin/shman:x:6:12:man:/var/cache/man:/bin/shlp:x:7:7:lp:/var/spool/lpd:/bin/shmail:x:8:8:mail:/var/mail:/bin/shnews:x:9:9:news:/var/spool/news:/bin/shuucp:x:10:10:uucp:/var/spool/uucp:/bin/shproxy:x:13:13:proxy:/bin:/bin/shwww-data:x:33:33:www-data:/var/www:/bin/shbackup:x:34:34:backup:/var/backups:/bin/shlist:x:38:38:Mailing List Manager:/var/list:/bin/shirc:x:39:39:ircd:/var/run/ircd:/bin/shgnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/shnobody:x:65534:65534:nobody:/nonexistent:/bin/shlibuuid:x:100:101::/var/lib/libuuid:/bin/shsyslog:x:101:103::/home/syslog:/bin/falsesshd:x:102:65534::/var/run/sshd:/usr/sbin/nologinjphilp:x:1000:1000:Jason Philp,,,:/home/jphilp:/bin/bashafarooq:x:1001:1001:Ahmed Farooq,,,:/home/afarooq:/bin/bashpostfix:x:103:106::/var/spool/postfix:/bin/falsedealwatch:x:1002:1003:,,,:/home/dealwatch:/bin/bash
Notice: Undefined index: old in /home/ibegin.com/public_html/weather/weather_widget.php on line 24Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64root:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/shsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/bin/shman:x:6:12:man:/var/cache/man:/bin/shlp:x:7:7:lp:/var/spool/lpd:/bin/shmail:x:8:8:mail:/var/mail:/bin/shnews:x:9:9:news:/var/spool/news:/bin/shuucp:x:10:10:uucp:/var/spool/uucp:/bin/shproxy:x:13:13:proxy:/bin:/bin/shwww-data:x:33:33:www-data:/var/www:/bin/shbackup:x:34:34:backup:/var/backups:/bin/shlist:x:38:38:Mailing List Manager:/var/list:/bin/shirc:x:39:39:ircd:/var/run/ircd:/bin/shgnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/shnobody:x:65534:65534:nobody:/nonexistent:/bin/shlibuuid:x:100:101::/var/lib/libuuid:/bin/shsyslog:x:101:103::/home/syslog:/bin/falsesshd:x:102:65534::/var/run/sshd:/usr/sbin/nologinjphilp:x:1000:1000:Jason Philp,,,:/home/jphilp:/bin/bashafarooq:x:1001:1001:Ahmed Farooq,,,:/home/afarooq:/bin/bashpostfix:x:103:106::/var/spool/postfix:/bin/falsedealwatch:x:1002:1003:,,,:/home/dealwatch:/bin/bash
Notice: Undefined index: old in /home/ibegin.com/public_html/weather/weather_widget.php on line 24Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64root:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/shsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/bin/shman:x:6:12:man:/var/cache/man:/bin/shlp:x:7:7:lp:/var/spool/lpd:/bin/shmail:x:8:8:mail:/var/mail:/bin/shnews:x:9:9:news:/var/spool/news:/bin/shuucp:x:10:10:uucp:/var/spool/uucp:/bin/shproxy:x:13:13:proxy:/bin:/bin/shwww-data:x:33:33:www-data:/var/www:/bin/shbackup:x:34:34:backup:/var/backups:/bin/shlist:x:38:38:Mailing List Manager:/var/list:/bin/shirc:x:39:39:ircd:/var/run/ircd:/bin/shgnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/shnobody:x:65534:65534:nobody:/nonexistent:/bin/shlibuuid:x:100:101::/var/lib/libuuid:/bin/shsyslog:x:101:103::/home/syslog:/bin/falsesshd:x:102:65534::/var/run/sshd:/usr/sbin/nologinjphilp:x:1000:1000:Jason Philp,,,:/home/jphilp:/bin/bashafarooq:x:1001:1001:Ahmed Farooq,,,:/home/afarooq:/bin/bashpostfix:x:103:106::/var/spool/postfix:/bin/falsedealwatch:x:1002:1003:,,,:/home/dealwatch:/bin/bash
Notice: Undefined index: old in /home/ibegin.com/public_html/weather/weather_widget.php on line 24Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64root:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/shsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/bin/shman:x:6:12:man:/var/cache/man:/bin/shlp:x:7:7:lp:/var/spool/lpd:/bin/shmail:x:8:8:mail:/var/mail:/bin/shnews:x:9:9:news:/var/spool/news:/bin/shuucp:x:10:10:uucp:/var/spool/uucp:/bin/shproxy:x:13:13:proxy:/bin:/bin/shwww-data:x:33:33:www-data:/var/www:/bin/shbackup:x:34:34:backup:/var/backups:/bin/shlist:x:38:38:Mailing List Manager:/var/list:/bin/shirc:x:39:39:ircd:/var/run/ircd:/bin/shgnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/shnobody:x:65534:65534:nobody:/nonexistent:/bin/shlibuuid:x:100:101::/var/lib/libuuid:/bin/shsyslog:x:101:103::/home/syslog:/bin/falsesshd:x:102:65534::/var/run/sshd:/usr/sbin/nologinjphilp:x:1000:1000:Jason Philp,,,:/home/jphilp:/bin/bashafarooq:x:1001:1001:Ahmed Farooq,,,:/home/afarooq:/bin/bashpostfix:x:103:106::/var/spool/postfix:/bin/falsedealwatch:x:1002:1003:,,,:/home/dealwatch:/bin/bash
Notice: Undefined index: old in /home/ibegin.com/public_html/weather/weather_widget.php on line 24Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64root:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/shsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/bin/shman:x:6:12:man:/var/cache/man:/bin/shlp:x:7:7:lp:/var/spool/lpd:/bin/shmail:x:8:8:mail:/var/mail:/bin/shnews:x:9:9:news:/var/spool/news:/bin/shuucp:x:10:10:uucp:/var/spool/uucp:/bin/shproxy:x:13:13:proxy:/bin:/bin/shwww-data:x:33:33:www-data:/var/www:/bin/shbackup:x:34:34:backup:/var/backups:/bin/shlist:x:38:38:Mailing List Manager:/var/list:/bin/shirc:x:39:39:ircd:/var/run/ircd:/bin/shgnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/shnobody:x:65534:65534:nobody:/nonexistent:/bin/shlibuuid:x:100:101::/var/lib/libuuid:/bin/shsyslog:x:101:103::/home/syslog:/bin/falsesshd:x:102:65534::/var/run/sshd:/usr/sbin/nologinjphilp:x:1000:1000:Jason Philp,,,:/home/jphilp:/bin/bashafarooq:x:1001:1001:Ahmed Farooq,,,:/home/afarooq:/bin/bashpostfix:x:103:106::/var/spool/postfix:/bin/falsedealwatch:x:1002:1003:,,,:/home/dealwatch:/bin/bash
Notice: Undefined index: old in /home/ibegin.com/public_html/weather/weather_widget.php on line 24Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64root:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/shsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/bin/shman:x:6:12:man:/var/cache/man:/bin/shlp:x:7:7:lp:/var/spool/lpd:/bin/shmail:x:8:8:mail:/var/mail:/bin/shnews:x:9:9:news:/var/spool/news:/bin/shuucp:x:10:10:uucp:/var/spool/uucp:/bin/shproxy:x:13:13:proxy:/bin:/bin/shwww-data:x:33:33:www-data:/var/www:/bin/shbackup:x:34:34:backup:/var/backups:/bin/shlist:x:38:38:Mailing List Manager:/var/list:/bin/shirc:x:39:39:ircd:/var/run/ircd:/bin/shgnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/shnobody:x:65534:65534:nobody:/nonexistent:/bin/shlibuuid:x:100:101::/var/lib/libuuid:/bin/shsyslog:x:101:103::/home/syslog:/bin/falsesshd:x:102:65534::/var/run/sshd:/usr/sbin/nologinjphilp:x:1000:1000:Jason Philp,,,:/home/jphilp:/bin/bashafarooq:x:1001:1001:Ahmed Farooq,,,:/home/afarooq:/bin/bashpostfix:x:103:106::/var/spool/postfix:/bin/falsedealwatch:x:1002:1003:,,,:/home/dealwatch:/bin/bash
Notice: Undefined index: old in /home/ibegin.com/public_html/weather/weather_widget.php on line 24Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64root:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/shsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/bin/shman:x:6:12:man:/var/cache/man:/bin/shlp:x:7:7:lp:/var/spool/lpd:/bin/shmail:x:8:8:mail:/var/mail:/bin/shnews:x:9:9:news:/var/spool/news:/bin/shuucp:x:10:10:uucp:/var/spool/uucp:/bin/shproxy:x:13:13:proxy:/bin:/bin/shwww-data:x:33:33:www-data:/var/www:/bin/shbackup:x:34:34:backup:/var/backups:/bin/shlist:x:38:38:Mailing List Manager:/var/list:/bin/shirc:x:39:39:ircd:/var/run/ircd:/bin/shgnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/shnobody:x:65534:65534:nobody:/nonexistent:/bin/shlibuuid:x:100:101::/var/lib/libuuid:/bin/shsyslog:x:101:103::/home/syslog:/bin/falsesshd:x:102:65534::/var/run/sshd:/usr/sbin/nologinjphilp:x:1000:1000:Jason Philp,,,:/home/jphilp:/bin/bashafarooq:x:1001:1001:Ahmed Farooq,,,:/home/afarooq:/bin/bashpostfix:x:103:106::/var/spool/postfix:/bin/falsedealwatch:x:1002:1003:,,,:/home/dealwatch:/bin/bash
Notice: Undefined index: old in /home/ibegin.com/public_html/weather/weather_widget.php on line 24Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64root:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/shsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/bin/shman:x:6:12:man:/var/cache/man:/bin/shlp:x:7:7:lp:/var/spool/lpd:/bin/shmail:x:8:8:mail:/var/mail:/bin/shnews:x:9:9:news:/var/spool/news:/bin/shuucp:x:10:10:uucp:/var/spool/uucp:/bin/shproxy:x:13:13:proxy:/bin:/bin/shwww-data:x:33:33:www-data:/var/www:/bin/shbackup:x:34:34:backup:/var/backups:/bin/shlist:x:38:38:Mailing List Manager:/var/list:/bin/shirc:x:39:39:ircd:/var/run/ircd:/bin/shgnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/shnobody:x:65534:65534:nobody:/nonexistent:/bin/shlibuuid:x:100:101::/var/lib/libuuid:/bin/shsyslog:x:101:103::/home/syslog:/bin/falsesshd:x:102:65534::/var/run/sshd:/usr/sbin/nologinjphilp:x:1000:1000:Jason Philp,,,:/home/jphilp:/bin/bashafarooq:x:1001:1001:Ahmed Farooq,,,:/home/afarooq:/bin/bashpostfix:x:103:106::/var/spool/postfix:/bin/falsedealwatch:x:1002:1003:,,,:/home/dealwatch:/bin/bash
Notice: Undefined index: old in /home/ibegin.com/public_html/weather/weather_widget.php on line 24Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64root:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/shsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/bin/shman:x:6:12:man:/var/cache/man:/bin/shlp:x:7:7:lp:/var/spool/lpd:/bin/shmail:x:8:8:mail:/var/mail:/bin/shnews:x:9:9:news:/var/spool/news:/bin/shuucp:x:10:10:uucp:/var/spool/uucp:/bin/shproxy:x:13:13:proxy:/bin:/bin/shwww-data:x:33:33:www-data:/var/www:/bin/shbackup:x:34:34:backup:/var/backups:/bin/shlist:x:38:38:Mailing List Manager:/var/list:/bin/shirc:x:39:39:ircd:/var/run/ircd:/bin/shgnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/shnobody:x:65534:65534:nobody:/nonexistent:/bin/shlibuuid:x:100:101::/var/lib/libuuid:/bin/shsyslog:x:101:103::/home/syslog:/bin/falsesshd:x:102:65534::/var/run/sshd:/usr/sbin/nologinjphilp:x:1000:1000:Jason Philp,,,:/home/jphilp:/bin/bashafarooq:x:1001:1001:Ahmed Farooq,,,:/home/afarooq:/bin/bashpostfix:x:103:106::/var/spool/postfix:/bin/falsedealwatch:x:1002:1003:,,,:/home/dealwatch:/bin/bash
Notice: Undefined index: old in /home/ibegin.com/public_html/weather/weather_widget.php on line 24Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64root:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/shsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/bin/shman:x:6:12:man:/var/cache/man:/bin/shlp:x:7:7:lp:/var/spool/lpd:/bin/shmail:x:8:8:mail:/var/mail:/bin/shnews:x:9:9:news:/var/spool/news:/bin/shuucp:x:10:10:uucp:/var/spool/uucp:/bin/shproxy:x:13:13:proxy:/bin:/bin/shwww-data:x:33:33:www-data:/var/www:/bin/shbackup:x:34:34:backup:/var/backups:/bin/shlist:x:38:38:Mailing List Manager:/var/list:/bin/shirc:x:39:39:ircd:/var/run/ircd:/bin/shgnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/shnobody:x:65534:65534:nobody:/nonexistent:/bin/shlibuuid:x:100:101::/var/lib/libuuid:/bin/shsyslog:x:101:103::/home/syslog:/bin/falsesshd:x:102:65534::/var/run/sshd:/usr/sbin/nologinjphilp:x:1000:1000:Jason Philp,,,:/home/jphilp:/bin/bashafarooq:x:1001:1001:Ahmed Farooq,,,:/home/afarooq:/bin/bashpostfix:x:103:106::/var/spool/postfix:/bin/falsedealwatch:x:1002:1003:,,,:/home/dealwatch:/bin/bash
Netsparker identified that the target web server is an Apache server. This was disclosed through the HTTP response. This information can help an attacker to gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of Apache.
Impact
An attacker can search for specific security vulnerabilities for the version of Apache identified within the SERVER header.
Remedy
Configure your web server to prevent information leakage from the SERVER header of its HTTP response.
Notice: Undefined index: old in /home/ibegin.com/public_html/weather/weather_widget.php on line 24Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64document.write('<div style="background-color: #ffffffffffff; color: #000000; width: 175px; padding: 10px; border: 1px #000000 solid; text-align: center; line-height: 1.6em; font-size: 11px; font-family: Verdana;"><b>WEBMASTER of this website:</b> The HTML you used is now out-dated. Please re-copy the HTML from <a href="http://www.showmyweather.com/">ShowMyWeather.com</a> without modification. Once updated the widget will function properly within 30 minutes.</div>');
Netsparker identified that the target web server is disclosing the PHP version in use through the HTTP response. This information can help an attacker to gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of PHP.
Impact
An attacker can look for specific security vulnerabilities for the version identified. Also the attacker can use this information in conjunction with the other vulnerabilities in the application or the web server.
Notice: Undefined index: old in /home/ibegin.com/public_html/weather/weather_widget.php on line 24Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64document.write('<div style="background-color: #ffffffffffff; color: #000000; width: 175px; padding: 10px; border: 1px #000000 solid; text-align: center; line-height: 1.6em; font-size: 11px; font-family: Verdana;"><b>WEBMASTER of this website:</b> The HTML you used is now out-dated. Please re-copy the HTML from <a href="http://www.showmyweather.com/">ShowMyWeather.com</a> without modification. Once updated the widget will function properly within 30 minutes.</div>');
Notice: Undefined index: old in /home/ibegin.com/public_html/weather/weather_widget.php on line 24Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64Notice: Undefined index: measure in /home/ibegin.com/public_html/weather/weather_widget.php on line 64document.write('<div style="background-color: #ffffffffffff; color: #000000; width: 175px; padding: 10px; border: 1px #000000 solid; text-align: center; line-height: 1.6em; font-size: 11px; font-family: Verdana;"><b>WEBMASTER of this website:</b> The HTML you used is now out-dated. Please re-copy the HTML from <a href="http://www.showmyweather.com/">ShowMyWeather.com</a> without modification. Once updated the widget will function properly within 30 minutes.</div>');
