From 5571bcf9e3541c604ab86edcead5d3a162f99077 Mon Sep 17 00:00:00 2001 From: Damien Regad Date: Sun, 28 Dec 2014 12:29:51 +0100 Subject: [PATCH] Install: disable step 4 (additional config info) This fixes a security issue allowing an attacker to access the installation script and obtain database access credentials. Since the offending install step does not seem to be doing anything useful, the corresponding code block has been commented out. This vulnerability (CVE-2014-9571) was reported by High-Tech Bridge Security Research Lab (https://www.htbridge.com/) in issue #17937 (advisory ID HTB23243). Fixes #17939 --- admin/install.php | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/admin/install.php b/admin/install.php index 577a32d379..77f616326f 100644 --- a/admin/install.php +++ b/admin/install.php @@ -751,7 +751,12 @@ function print_test( $p_test_description, $p_result, $p_hard_fail = true, $p_mes # database installed, get any additional information if( 4 == $t_install_state ) { - /** @todo to be written */ +/* + # 20141227 dregad Disabling this step for now, because it does not seem to + # be doing anything useful and can be used to retrieve system information + # when the admin directory has not been deleted (see #17939). + + # @todo to be written // must post data gathered to preserve it ?> @@ -766,6 +771,7 @@ function print_test( $p_test_description, $p_result, $p_hard_fail = true, $p_mes # rather than the following line +*/ $t_install_state++; } # end install_state == 4