The Search module in Drupal version 7.x suffers from a path disclosure vulnerability.
2cb98aabe430fa8a3632585b5b1bb940d31ac363c2c9e56cabfc26ea0bac5afa
Drupal 7.x Search Module - Full Path Disclosure
==============
Summary
Full path disclosure due to insufficient input validation in the search module.
==============
Description
Performing a search with the "keys" parameter set as an array, an error message shows the full path of the Drupal installation, leading to possible further attacks.
For the error messages to be displayed, php.ini's display_errors must be On.
Authentication: Not Needed
==============
Mitigation
Correct input validation for the "key" parameters
==============
Exploit PoC
example.com/?q=search&keys[]=securitate.md
==============
Affected Versions
Versions 7 < 7.12 are affected.
Not tested on 6.
==============
Credits
Ursu Mihail [ http://securitate.md ]
==============
Disclosure Timeline
Reported to vendor on 1 Mar 2012.
Response from vendor:
Disclosure of the path is not considered a security risk.
Drupal has a configuration setting which allows PHP warnings to be printed to the screen for debugging purposes... For production websites, it is a good idea to turn this off, and the messages will not be displayed.
==============
Comments
Unfortunately for them, many sites display errors in production.
==============