| عنوان | itsmeravitejak Online-Examination-System e6208e630b14657999bbfe4c9912302d2a1e2449 Storage of File with Sensitive Data Under Web Root |
|---|
| الوصف | The affected component is the web root of the application, which ships and serves sensitive files: `dbtables.sql` (the full database dump used by the documented installation procedure) and the PHP source backups `exam-ajax.php.backup` and `disp.php.backup`, plus `include/database - Copy.php`. Because these files live inside the document root and have non-PHP extensions (or are static), the web server delivers their raw contents to any visitor without authentication. `dbtables.sql` contains the `users` table with the MD5 password hashes of the default accounts, the administrator's fixed `userid` session token (`d3f0b93bf63fefad081eb1f2cbb59d10` - which alone enables the cookie-based authentication bypass reported separately), email addresses and the full schema. The `.backup` files disclose the application source code of the exam AJAX flow.
|
|---|
| المصدر | ⚠️ https://github.com/itsmeravitejak/Online-Examination-System/issues/9 |
|---|
| المستخدم | yunshen (UID 100191) |
|---|
| ارسال | 28/09/2026 07:18 PM (22 أيام منذ) |
|---|
| الاعتدال | 14/10/2026 03:55 PM (16 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 419855 [itsmeravitejak Online-Examination-System حتى e6208e630b14657999bbfe4c9912302d2a1e2449 dbtables.sql الكشف عن المعلومات] |
|---|
| النقاط | 20 |
|---|