| Titel | itsmeravitejak Online-Examination-System e6208e630b14657999bbfe4c9912302d2a1e2449 Storage of File with Sensitive Data Under Web Root |
|---|
| Beschreibung | The affected component is the web root of the application, which ships and serves sensitive files: `dbtables.sql` (the full database dump used by the documented installation procedure) and the PHP source backups `exam-ajax.php.backup` and `disp.php.backup`, plus `include/database - Copy.php`. Because these files live inside the document root and have non-PHP extensions (or are static), the web server delivers their raw contents to any visitor without authentication. `dbtables.sql` contains the `users` table with the MD5 password hashes of the default accounts, the administrator's fixed `userid` session token (`d3f0b93bf63fefad081eb1f2cbb59d10` - which alone enables the cookie-based authentication bypass reported separately), email addresses and the full schema. The `.backup` files disclose the application source code of the exam AJAX flow.
|
|---|
| Quelle | ⚠️ https://github.com/itsmeravitejak/Online-Examination-System/issues/9 |
|---|
| Benutzer | yunshen (UID 100191) |
|---|
| Einreichung | 28.09.2026 19:18 (vor 22 Tagen) |
|---|
| Moderieren | 14.10.2026 15:55 (16 days later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 419855 [itsmeravitejak Online-Examination-System bis e6208e630b14657999bbfe4c9912302d2a1e2449 dbtables.sql Information Disclosure] |
|---|
| Punkte | 20 |
|---|