| Titolo | SourceCodester Online Clothing Store 1.0 Sensitive Information Disclosure |
|---|
| Descrizione | A critical Sensitive Information Disclosure vulnerability was identified in the target web application due to a publicly accessible SQL database backup file. The backup file could be accessed and downloaded without any authentication or authorization, exposing the complete database contents.
The exposed SQL backup contained highly sensitive information, including administrator credentials, user account details, application data, and other confidential records. An unauthenticated attacker could download the backup, extract valid administrative credentials, and potentially gain unauthorized access to the application's administrative panel. This could result in complete compromise of the application, unauthorized data access, modification or deletion of records, and further attacks against the organization.
The root cause of this issue was the insecure storage of database backup files within a publicly accessible web directory, combined with the absence of proper access controls. Database backup files should never be accessible from the internet and must be securely stored outside the web root with appropriate access restrictions.
Security Impact: Critical |
|---|
| Fonte | ⚠️ https://medium.com/@hemantrajbhati5555/sensitive-information-disclosure-via-publicly-accessible-sql-backup-leading-to-administrative-50bac3a307aa |
|---|
| Utente | Hemant Raj Bhati (UID 95613) |
|---|
| Sottomissione | 26/06/2026 13:57 (2 mesi fa) |
|---|
| Moderazione | 14/08/2026 21:27 (2 months later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 390096 [SourceCodester Online Clothing Store 1.0 SQL Database Backup /db/shopping.sql escalationi di privilegi] |
|---|
| Punti | 20 |
|---|