Mercuryboard debug information disclosure

################################################
Mercuryboard 1.0.x & 1.1.x debug information disclosure
vendor url: http://www.mercuryboard.com
advisore:http://lostmon.blogspot.com/2005/02/
mercuryboard-debug-information.html
OSVDB ID:13787
exploit avaible :yes vendor: emailed
Secunia:SA14284
Securitytracker:1013626
################################################


MercuryBoard is a powerful message board system dedicated to raw speed with a mixture of features, ease of use, and ease of customization coupled with expandability, and diverse language services


Mercuryboard contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a any user manipulates the imputs in the url and added \&debug=1 at url or concatenate &debug=1, occurs, which will disclose all sql querys ,all files are in use ,path disclosure, and what templates used this information resulting in a loss of confidentiality.

afected versions :

1.0.x
1.1.x
1.1.3 not afected

Proof of concept

http://[target]/index.php?a=forum&f=\&debug=1
http://[target]/index.php?a=\&debug=1
http://[target]/index.php?a=&debug=1
http://[target]/index.php?a=forum&debug=1
http://[target]/index.php?c=&debug=1

impact:

Loss of confidenciality
Information disclosure
path disclosure
imput manipulation.

solution:

need to update tu version 1.1.3 this issue is solved in this version

release time :

Discovered : 2005-02-13
Email to vendor: 2005-02-13
disclosure date: 2005-02-14
updated : 2005-04-02
Atentamente:

Lostmon (lostmon@gmail.com)

Thnx to estrella Ke tailoviu un monton :P
thnx to http://www.hispanew.com for support.
http://Lostmon.blogsport.com/
--
La curiosidad es lo que hace mover la mente....