-1

I found a website with the error below:

Notice: Undefined index: welcome in /var/www/html/blah/index.php on line 14

Is that a vulnerability?

2

A bug like that could be a vulnerability, but it does not have to be one. It might not even be likely that it is one. While all vulnerabilities are bugs, all bugs are not vulnerabilities. It is impossible to say more without more information.

The error message is simply what you get when you try to look up a key that does not exist in a PHP associative array. So that is the error you would get if you run $my_array["welcome"] when there is no value for "welcome" in $my_array.

  • I understood what you said but how that could be vulnerability so user can exploit it – Hijack Apr 13 '18 at 11:42
  • It's impossible to say without knowing anything else. The vulnerability would be in how the error interacts with some other thing in the system, but since we know of nothing else... there is no way to tell. Probably there is no vulnerability, but without any more info than that you cant rule anything out. – Anders Apr 13 '18 at 11:44
  • if nothing else it tells you that that web page is written in PHP, which could help an attacker. – Jasen Apr 14 '18 at 7:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.