Full Path Disclosure
Full Path Disclose (AKA, FPD) vulnerabilities enable the attacker to see the path to the webroot/file. Eg: /home/omg/htdocs/file/. Certain vulnerabilities such as using the load_file() query to view page sources require the attacker to have the full path to the file they wish to view.
Low to Medium (circumstantial)
- Empty Array
If we have a site that uses a method of requesting a page like this:
We can use a method of opening and closing braces and causing the page to output an error. This method would look like this:
This renders the page defunct thus spitting out an error:
Warning: opendir(Array): failed to open dir: No such file or directory in /home/omg/htdocs/index.php on line 84 Warning: pg_num_rows(): supplied argument ... in /usr/home/example/html/pie/index.php on line 131