| 제목 | code-projects Simple Inventory System In PHP With Source Code 1.0 Information Disclosure |
|---|
| 설명 | The Simple Inventory System in PHP v1.0 is affected by a Sensitive Information Disclosure vulnerability caused by an exposed database backup file.
The vulnerability exists because the application stores a MySQL database dump (inventorymanagement.sql) inside a directory that is publicly accessible through the web server. Since the backup file resides within the application's web root and no authentication or access restrictions are enforced, any remote user can directly access and download the database backup by requesting the file through a web browser.
The exposed database file contains the complete database schema together with all stored application data. Depending on the deployment and application usage, this information may include administrator accounts, employee information, customer records, supplier details, inventory information, transaction history, authentication data, and other confidential business records.
An attacker can exploit this vulnerability simply by sending an HTTP GET request to the exposed SQL backup file. No authentication, authorization, or user interaction is required. Once downloaded, the attacker gains full access to the database contents and can analyze the application's internal structure offline.
Exposure of the database significantly increases the overall attack surface. The disclosed information may enable attackers to identify valid user accounts, recover weak or improperly protected passwords, enumerate database tables and relationships, obtain sensitive business information, and use the collected data to facilitate additional attacks such as account compromise, privilege escalation, SQL injection, or social engineering.
The vulnerability is caused by insecure deployment practices in which backup files are placed inside publicly accessible directories rather than being stored outside the document root or protected by appropriate access controls. Because backup files are accessible through predictable URLs and the web server allows direct access to .sql files, sensitive information can be retrieved by any unauthenticated user.
Successful exploitation may result in complete disclosure of the application's backend database and expose highly sensitive information, posing a significant risk to the confidentiality of both the application and its users. This issue is classified as Sensitive Information Disclosure (CWE-200) resulting from improper server configuration and insecure storage of backup files. |
|---|
| 원천 | ⚠️ https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Sensitive%20Information%20Disclosure%20in%20Simple%20Inventory%20System%20PHP%20Exposed%20Database%20Backup.md |
|---|
| 사용자 | AhmadMarzook (UID 96211) |
|---|
| 제출 | 2026. 07. 16. PM 10:50 (1 월 ago) |
|---|
| 모더레이션 | 2026. 08. 30. AM 10:12 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 397124 [code-projects Simple Inventory System 1.0 Database Backup File inventorymanagement.sql 정보 공개] |
|---|
| 포인트들 | 20 |
|---|