| Título | itsmeravitejak Online-Examination-System e6208e630b14657999bbfe4c9912302d2a1e2449 Storage of File with Sensitive Data Under Web Root |
|---|
| Descrição | The affected component is the web root of the application, which ships and serves sensitive files: `dbtables.sql` (the full database dump used by the documented installation procedure) and the PHP source backups `exam-ajax.php.backup` and `disp.php.backup`, plus `include/database - Copy.php`. Because these files live inside the document root and have non-PHP extensions (or are static), the web server delivers their raw contents to any visitor without authentication. `dbtables.sql` contains the `users` table with the MD5 password hashes of the default accounts, the administrator's fixed `userid` session token (`d3f0b93bf63fefad081eb1f2cbb59d10` - which alone enables the cookie-based authentication bypass reported separately), email addresses and the full schema. The `.backup` files disclose the application source code of the exam AJAX flow.
|
|---|
| Fonte | ⚠️ https://github.com/itsmeravitejak/Online-Examination-System/issues/9 |
|---|
| Utilizador | yunshen (UID 100191) |
|---|
| Submissão | 28/09/2026 19h18 (há 22 dias) |
|---|
| Moderação | 14/10/2026 15h55 (16 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 419855 [itsmeravitejak Online-Examination-System até e6208e630b14657999bbfe4c9912302d2a1e2449 dbtables.sql Divulgação de Informação] |
|---|
| Pontos | 20 |
|---|