CVEs-PoC/2012/CVE-2012-1105.md

### [CVE-2012-1105](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1105)
![](https://img.shields.io/static/v1?label=Product&message=php-pear-CAS&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=1.2.2%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Debug%20log%20and%20proxy%20configuration%20session%20data%20stored%20in%20%2Ftmp%20without%20proper%20protection&color=brightgreen)

### Description

An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory. The Central Authentication Service client library archives the debug logging file in an insecure manner.

### POC

#### Reference
- https://gitlab.vsb.cz/kal0178/sixmon/blob/b18bcde090dc38fc968a0b1e38d1dab08b8c369e/web/lib/CAS/CAS-1.3.5/docs/ChangeLog

#### Github
No PoCs found on GitHub currently.