| عنوان | Dígitro NGC Explorer 3.44.15 Plaintext Password in Configuration File |
|---|
| الوصف | Title: NGC Explorer version 3.44.15 Client-side DOM manipulation allows password exposure
Software affected: NGC Explorer version 3.44.15
Vendor: Dígitro Tecnologia - https://digitro.com/
Description:
A configuration page contains an input field of type password, pre-filled with a sensitive SIP service credential. However, there is no defense against DOM manipulation. By changing the field type to text using browser DevTools, the stored password becomes visible in plaintext.
Technical Details:
An attacker with local access can open browser DevTools (F12), locate the password input field, and change the type="password" attribute to type="text", revealing the user’s password.
Impact:
Sensitive credentials can be exposed to unauthorized users, especially in shared or public environments.
Evidences of exploitation will be send by e-mail. |
|---|
| المستخدم | Anonymous User |
|---|
| ارسال | 24/04/2025 11:21 PM (1 سنة منذ) |
|---|
| الاعتدال | 10/05/2025 07:30 AM (15 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 308271 [Dígitro NGC Explorer حتى 3.44.15/3.48.21 Configuration Page الكشف عن المعلومات] |
|---|
| النقاط | 17 |
|---|