| タイトル | code-projects Student Crud Operation In PHP 1.0 Information Disclosure |
|---|
| 説明 | Student CRUD Operation in PHP contains a Sensitive Information Disclosure vulnerability due to the presence of a publicly accessible SQL database file named card_activation.sql.
The affected database resource is located at:
/Student-Registration-Crud-Operation/card_activation.sql
The vulnerability occurs because the SQL file is placed within a directory served directly by the web server without sufficient access restrictions.
An attacker does not need to exploit SQL injection, bypass application functionality, or manipulate application parameters to access the affected resource. Instead, the attacker can directly request the predictable SQL filename through HTTP.
If the web server returns the resource, the attacker obtains the SQL dump without passing through the application's intended access-control mechanisms.
SQL database dumps commonly contain statements used to recreate the application's backend database. Depending on the contents of card_activation.sql, the disclosed information may include database table definitions, column names, relationships, application records, account information, configuration values, or other information maintained by the application.
If user records or authentication information are present, exposure could further disclose usernames, email addresses, password hashes or improperly stored passwords, and other account-related information. Such data categories should only be listed as confirmed impact if they are actually present in the exposed file.
Even when the dump contains only database schema information, disclosure provides an attacker with detailed knowledge of the application's internal database architecture. This information can assist in identifying table names, sensitive columns, relationships between application components, and potentially vulnerable database operations.
The vulnerability therefore represents an insecure deployment and information exposure issue in which a database resource that should remain private is made accessible through the public web interface.
|
|---|
| ソース | ⚠️ https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Student%20CRUD%20Operation%20in%20PHP%20%E2%80%93%20Sensitive%20Information%20Disclosure%20via%20Exposed%20%60card_activation.sql%60%20Database%20File.md |
|---|
| ユーザー | AhmadMarzouk (UID 95993) |
|---|
| 送信 | 2026年07月29日 18:44 (1 月 ago) |
|---|
| モデレーション | 2026年09月07日 21:29 (1 month later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 399673 [code-projects Student Crud Operation 1.0 Backup File /card_activation.sql 情報漏えい] |
|---|
| ポイント | 20 |
|---|