| Название | SourceCodester Online Clothing Store 1.0 Sensitive Information Disclosure |
|---|
| Описание | A critical Sensitive Information Disclosure vulnerability was identified in the target web application due to a publicly accessible SQL database backup file. The backup file could be accessed and downloaded without any authentication or authorization, exposing the complete database contents.
The exposed SQL backup contained highly sensitive information, including administrator credentials, user account details, application data, and other confidential records. An unauthenticated attacker could download the backup, extract valid administrative credentials, and potentially gain unauthorized access to the application's administrative panel. This could result in complete compromise of the application, unauthorized data access, modification or deletion of records, and further attacks against the organization.
The root cause of this issue was the insecure storage of database backup files within a publicly accessible web directory, combined with the absence of proper access controls. Database backup files should never be accessible from the internet and must be securely stored outside the web root with appropriate access restrictions.
Security Impact: Critical |
|---|
| Источник | ⚠️ https://medium.com/@hemantrajbhati5555/sensitive-information-disclosure-via-publicly-accessible-sql-backup-leading-to-administrative-50bac3a307aa |
|---|
| Пользователь | Hemant Raj Bhati (UID 95613) |
|---|
| Представление | 26.06.2026 13:57 (2 месяцы назад) |
|---|
| Модерация | 14.08.2026 21:27 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 390096 [SourceCodester Online Clothing Store 1.0 SQL Database Backup /db/shopping.sql эскалация привилегий] |
|---|
| Баллы | 20 |
|---|