TOPo is a free TOP system written in PHP that works without a MySQL database. TOPo is specially designed for web sites hosted in web servers that do not offer a quality MySQL support.
A vulnerability in the product allows attackers to reveal the true path of the PHP script files on the server.
Vulnerable versions:
* TOPo Version 1.43 and below
Immune Versions:
* TOPo Version 2.0.081 and above.
This vulenrability allows a user to read the full path to the in.php and out.php files' location.
This is a security hazard, as it gives attackers restricted information about the structure of the hosting webserver.
The result will contain something like: Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /path/to/php/in.php on line 5 Warning ...
