| Titre | itsmeravitejak Online-Examination-System e6208e630b14657999bbfe4c9912302d2a1e2449 Storage of File with Sensitive Data Under Web Root |
|---|
| Description | The affected component is the web root of the application, which ships and serves sensitive files: `dbtables.sql` (the full database dump used by the documented installation procedure) and the PHP source backups `exam-ajax.php.backup` and `disp.php.backup`, plus `include/database - Copy.php`. Because these files live inside the document root and have non-PHP extensions (or are static), the web server delivers their raw contents to any visitor without authentication. `dbtables.sql` contains the `users` table with the MD5 password hashes of the default accounts, the administrator's fixed `userid` session token (`d3f0b93bf63fefad081eb1f2cbb59d10` - which alone enables the cookie-based authentication bypass reported separately), email addresses and the full schema. The `.backup` files disclose the application source code of the exam AJAX flow.
|
|---|
| La source | ⚠️ https://github.com/itsmeravitejak/Online-Examination-System/issues/9 |
|---|
| Utilisateur | yunshen (UID 100191) |
|---|
| Soumission | 28/09/2026 19:18 (il y a 23 jours) |
|---|
| Modérer | 14/10/2026 15:55 (16 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 419855 [itsmeravitejak Online-Examination-System dbtables.sql divulgation d'information] |
|---|
| Points | 20 |
|---|