<?xml version="1.0" encoding="UTF-8"?><!-- generator="wordpress/MustLive Edition" -->
<rss version="2.0" 
	xmlns:content="http://purl.org/rss/1.0/modules/content/">
<channel>
	<title>Коментарі для запису: Full path disclosure в WordPress</title>
	<link>http://websecurity.com.ua/1973/</link>
	<description></description>
	<pubDate>Sun, 19 Apr 2026 02:57:07 +0000</pubDate>
	<generator>http://wordpress.org/?v=MustLive Edition</generator>

	<item>
		<title>від: MustLive</title>
		<link>http://websecurity.com.ua/1973/#comment-119857</link>
		<pubDate>Mon, 07 Apr 2008 20:55:16 +0000</pubDate>
		<guid>http://websecurity.com.ua/1973/#comment-119857</guid>
					<description>&lt;strong&gt;beford&lt;/strong&gt;

Yes, people mostly don't care about full path disclosure holes. As it can be seen from my articles &lt;a href="/1938/" rel="nofollow"&gt;”Warning” Google hacking&lt;/a&gt; (there are millions of such holes in Internet ;-)).

From FPD vulnerabilities it's very often possible to find FTP login, also it's often possible to find DB login (such as MySQL) and even database name (sometimes DB name and login are identical). And main information leakage from FPD - it is path at server, which can be used for Directory Traversal and Local Inclusion attacks.

P.S.

This FPD - it's old hole, which was disclosed last year (and I just found time to wrote about it). There are many other full path disclosure holes in WP which were disclosed in 2007 year (and I wrote about them). I also found many such holes in WordPress last year, like I wrote in this post, and you can look at them at next posts:

http://websecurity.com.ua/1634/
http://websecurity.com.ua/1679/
http://websecurity.com.ua/1683/
http://websecurity.com.ua/1687/</description>
		<content:encoded><![CDATA[<p><strong>beford</strong></p>
<p>Yes, people mostly don&#8217;t care about full path disclosure holes. As it can be seen from my articles <a href="/1938/" rel="nofollow">”Warning” Google hacking</a> (there are millions of such holes in Internet <img src='http://websecurity.com.ua/wp-includes/images/smilies/icon_wink.gif' alt=';-)' class='wp-smiley' /> ).</p>
<p>From FPD vulnerabilities it&#8217;s very often possible to find FTP login, also it&#8217;s often possible to find DB login (such as MySQL) and even database name (sometimes DB name and login are identical). And main information leakage from FPD - it is path at server, which can be used for Directory Traversal and Local Inclusion attacks.</p>
<p>P.S.</p>
<p>This FPD - it&#8217;s old hole, which was disclosed last year (and I just found time to wrote about it). There are many other full path disclosure holes in WP which were disclosed in 2007 year (and I wrote about them). I also found many such holes in WordPress last year, like I wrote in this post, and you can look at them at next posts:</p>
<p><a href="http://websecurity.com.ua/1634/" rel="nofollow">http://websecurity.com.ua/1634/</a><br />
<a href="http://websecurity.com.ua/1679/" rel="nofollow">http://websecurity.com.ua/1679/</a><br />
<a href="http://websecurity.com.ua/1683/" rel="nofollow">http://websecurity.com.ua/1683/</a><br />
<a href="http://websecurity.com.ua/1687/" rel="nofollow">http://websecurity.com.ua/1687/</a>
</p>
]]></content:encoded>
				</item>
	<item>
		<title>від: beford</title>
		<link>http://websecurity.com.ua/1973/#comment-118639</link>
		<pubDate>Mon, 31 Mar 2008 07:47:04 +0000</pubDate>
		<guid>http://websecurity.com.ua/1973/#comment-118639</guid>
					<description>cool FPD. Most people don't care about this kind of bugs, they dont consider important the fact that most of the time this information allows attackers to know their FTP username ;)</description>
		<content:encoded><![CDATA[<p>cool FPD. Most people don&#8217;t care about this kind of bugs, they dont consider important the fact that most of the time this information allows attackers to know their FTP username <img src='http://websecurity.com.ua/wp-includes/images/smilies/icon_wink.gif' alt=';)' class='wp-smiley' />
</p>
]]></content:encoded>
				</item>
</channel>
</rss>
