| タイトル | code-projects Matrimonial System IN PHP, CSS, JS, AND MYSQL 1.0 Information Disclosure |
|---|
| 説明 | A sensitive information disclosure vulnerability exists in the Code-Projects Matrimonial System in PHP, CSS, JS, and MySQL due to the inclusion of sensitive user information and plaintext credentials within the publicly accessible db/matrimony.sql database dump. The SQL file can be accessed without authentication through the application's /db/ directory and opened directly in a text editor, exposing user Personally Identifiable Information (PII), including dates of birth, gender, email addresses, and associated credential information. An unauthenticated attacker who can access the distributed project files may therefore obtain sensitive account data and potentially use exposed credentials to gain unauthorized access to affected accounts or application functionality. The issue is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).
CVSS: 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N — 7.5 (High)
Researchers Information
Researcher - 1
Name: Karan Parelkar
Independent Security Researcher
Email: [email protected]
GitHub: https://github.com/KaranParelkar
LinkedIn: https://www.linkedin.com/in/karan-parelkar-6a370125b/
Researcher – 2
Name: Abhishek Pisal
Independent Security Researcher
Email: [email protected]
GitHub: https://github.com/EvilGod108
LinkedIn: https://www.linkedin.com/in/abhishek-pisal-a358bb255/
Researcher – 3
Name: Gaurang Kalyankar
Independent Security Researcher
Email: [email protected]
Linkedin: https://www.linkedin.com/in/gaurang-kalyankar-cybersecurity/ |
|---|
| ソース | ⚠️ https://github.com/KaranParelkar/Matrimonial_system_sqli/blob/main/Information%20Disclosure/Readme.md |
|---|
| ユーザー | KaranParelkar (UID 99714) |
|---|
| 送信 | 2026年09月24日 11:41 (19 日 ago) |
|---|
| モデレーション | 2026年10月11日 20:27 (17 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 416762 [code-projects Matrimonial System 1.0 db/matrimony.sql 特権昇格] |
|---|
| ポイント | 20 |
|---|