Imnot going to act like a "homo thug" like that other guy di a few weeks ago.

While testing out php's file functions, I was able to read most directories and files on the servers. I was unable to open any UNix password files, but I was able to go through people's php and cgi files unparced. A lot of yall are saying bigwoop, but many people keep there admin password and database passwords in these files. I didn't go looking through anybodies admin sites or databases though.

The reason I think this is a CPanel bug is because all CPanel sites are in the directory (usualy "/home")on a virtual host. With php file functions I was able to read all of the directories in this file. Then when I would try to open on of these files, it siad I din't have permission. But since CPanel sites are pretty much identical I opend the directory "/home/accountname/public_html", and I was able to read through everyones unparsed information.

My question is...Where do I go to report this?

http://www.cpanel.net ;)

Its not a cpanel bug.
You can view other peoples' files but you can't open them.
As long as the permissions and ownership is set correct you can't just open the file.

I was able to open the file

example:

-------------
VIEW DIR
-------------

$dir=""; //ie. /home/accountname/public_html


$handle=opendir($dir);
while (false!==($file = readdir($handle))) {
if ($file != "." && $file != "..") {
echo "$file<br>\n";

-------------
VIEW FILE
-------------

$dir = ""; //ie. /home/accountname/public_html
$file = ""; //ie. index.php3

echo readfile("$dir/$file");

Don't know if its me but updated cpanel have too many bugs.