Exposed Log File Lead to Full Internal path disclosure at [https://nextcloud.com/wp-content/debug.log]

Disclosed: 2022-12-15 22:22:38 By 0x3bdo To nextcloud
Low
Vulnerability Details
Hi team , i found wp-content/debug.log endpoint public accessible That lead to full path disclosure Steps : Open : https://nextcloud.com/wp-content/debug.log You can See Internal paths disclosed and date is : 02-Nov-2022 ``` [02-Nov-2022 08:50:36 UTC] PHP Fatal error: Uncaught Error: Call to undefined method WP_Textdomain_Registry::reset() in █████████plugins/wpml-string-translation/classes/MO/Hooks/LanguageSwitch.php:139 Stack trace: #0 ███████plugins/wpml-string-translation/classes/MO/Hooks/LanguageSwitch.php(119): WPML\ST\MO\Hooks\LanguageSwitch->resetTranslationAvailabilityInformation() #1 ███plugins/wpml-string-translation/classes/MO/Hooks/LanguageSwitch.php(73): WPML\ST\MO\Hooks\LanguageSwitch->changeMoObjects() #2 ███plugins/wpml-string-translation/classes/MO/Hooks/LanguageSwitch.php(48): WPML\ST\MO\Hooks\LanguageSwitch->switchToLocale() #3 ██████class-wp-hook.php(310): WPML\ST\MO\Hooks\LanguageSwitch->languageHasSwitched() #4 ██████████class-wp-hook.php(332): WP_Hook->apply_filters() #5 ██████plugin.php(517): WP_Hook->do_action() #6 █████████plugins/sitepress-multilingual-cms/sitepress.class.php(1178): do_action() #7 in █████plugins/wpml-string-translation/classes/MO/Hooks/LanguageSwitch.php on line 139 [02-Nov-2022 08:50:36 UTC] PHP Fatal error: Uncaught Error: Call to undefined method WP_Textdomain_Registry::reset() in █████████plugins/wpml-string-translation/classes/MO/Hooks/LanguageSwitch.php:139 Stack trace: #0 ████████plugins/wpml-string-translation/classes/MO/Hooks/LanguageSwitch.php(119): WPML\ST\MO\Hooks\LanguageSwitch->resetTranslationAvailabilityInformation() #1 ██████plugins/wpml-string-translation/classes/MO/Hooks/LanguageSwitch.php(73): WPML\ST\MO\Hooks\LanguageSwitch->changeMoObjects() #2 ██████plugins/wpml-string-translation/classes/MO/Hooks/LanguageSwitch.php(48): WPML\ST\MO\Hooks\LanguageSwitch->switchToLocale() #3 ██████████class-wp-hook.php(310): WPML\ST\MO\Hooks\LanguageSwitch->languageHasSwitched() #4 █████████class-wp-hook.php(332): WP_Hook->apply_filters() #5 ███████plugin.php(517): WP_Hook->do_action() #6 ████████plugins/sitepress-multilingual-cms/sitepress.class.php(1178): do_action() #7 in ███plugins/wpml-string-translation/classes/MO/Hooks/LanguageSwitch.php on line 139 [02-Nov-2022 08:50:36 UTC] PHP Fatal error: Uncaught Error: Call to undefined method WP_Textdomain_Registry::reset() in ██████████plugins/wpml-string-translation/classes/MO/Hooks/LanguageSwitch.php:139 Stack trace: #0 ████████plugins/wpml-string-translation/classes/MO/Hooks/LanguageSwitch.php(119): WPML\ST\MO\Hooks\LanguageSwitch->resetTranslationAvailabilityInformation() #1 ████████plugins/wpml-string-translation/classes/MO/Hooks/LanguageSwitch.php(73): WPML\ST\MO\Hooks\LanguageSwitch->changeMoObjects() #2 ██████plugins/wpml-string-translation/classes/MO/Hooks/LanguageSwitch.php(48): WPML\ST\MO\Hooks\LanguageSwitch->switchToLocale() #3 ████class-wp-hook.php(310): WPML\ST\MO\Hooks\LanguageSwitch->languageHasSwitched() #4 ████████class-wp-hook.php(332): WP_Hook->apply_filters() #5 ███████plugin.php(517): WP_Hook->do_action() #6 ████plugins/sitepress-multilingual-cms/sitepress.class.php(1178): do_action() #7 in ████████plugins/wpml-string-translation/classes/MO/Hooks/LanguageSwitch.php on line 139 [02-Nov-2022 08:50:36 UTC] PHP Fatal error: Uncaught Error: Call to undefined method WP_Textdomain_Registry::reset() in █████plugins/wpml-string-translation/classes/MO/Hooks/LanguageSwitch.php:139 Stack trace: ``` ## Impact Exposed Log file lead to exposed all internal paths
Actions
View on HackerOne
Report Stats
  • Report ID: 1767439
  • State: Closed
  • Substate: resolved
  • Upvotes: 13
Share this report