D_Bug

**Name of the Vulnerable Software and Affected Versions** Bitrix Site Manager versions 4.0.x **Description** The issue allows remote attackers to obtain sensitive information by making a direct request to certain files. Specifically, requests to "subscr form.php" or "dbquery error.php" can reveal the path in an error message. **Recommendations** For versions 4.0.x, consider restricting access to the "subscr form.php" and "dbquery error.php" files to minimize the risk of exploitation. As a temporary workaround, disabling error messages that reveal sensitive information can also help mitigate the issue.

**Name of the Vulnerable Software and Affected Versions** Bitrix Site Manager versions 4.0.x **Description** The issue allows remote attackers to execute arbitrary PHP code via the `DOCUMENT ROOT` parameter in the `start.php` file. This can be exploited by manipulating the ` SERVER[DOCUMENT ROOT]` parameter. **Recommendations** For Bitrix Site Manager versions 4.0.x, consider restricting access to the `start.php` file until a patch is available. As a temporary workaround, avoid using the ` SERVER[DOCUMENT ROOT]` parameter in the affected file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** McGallery version 1.1 **Description** The issue allows remote attackers to connect to arbitrary databases or gain sensitive information by triggering an error. This is achieved via a modified `host` parameter in the `show.php` file. **Recommendations** For McGallery version 1.1, consider restricting access to the `show.php` file until a patch is available, and avoid using modified `host` parameters to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** McGallery version 1.1 **Description** The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the admin.php file. This is achieved by using a .. (dot dot) in the `lang` parameter. **Recommendations** For McGallery version 1.1, consider restricting access to the admin.php file or the `lang` parameter to minimize the risk of exploitation until a patch is available.