| Название | code-projects Online Ticket Reservation System 1.0 File and Directory Information Exposure |
|---|
| Описание | The Online Ticket Reservation System distributed by code-projects.org is affected by sensitive information disclosure (CWE-200) due to the presence of credential-related information in the publicly distributed `ticket_reservation/database/medallion.sql` database dump. When the application is deployed with the provided project structure, the `/database/` directory may be web-accessible, allowing an unauthenticated user to directly access and download `medallion.sql` without authentication or exploitation of another vulnerability. Inspection of the SQL dump reveals application account credentials, including a password hash, which can be obtained and subjected to offline password-cracking attempts. If the corresponding password is recovered and the credentials remain valid, an attacker may be able to authenticate to the affected application and gain unauthorized access to application functionality and potentially sensitive data. The issue can be mitigated by removing real credentials from distributed database dumps, using dummy credentials for testing, preventing web access to database/backup files, rotating exposed credentials, and using a modern password-hashing algorithm such as Argon2id or bcrypt for password storage.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N — 7.5 (High)
Researchers Information
Researcher - 1
Name: Karan Parelkar
Independent Security Researcher
Email: [email protected]
GitHub: https://github.com/KaranParelkar
LinkedIn: https://www.linkedin.com/in/karan-parelkar-6a370125b/
Researcher – 2
Name: Abhishek Pisal
Independent Security Researcher
Email: [email protected]
GitHub: https://github.com/EvilGod108
LinkedIn: https://www.linkedin.com/in/abhishek-pisal-a358bb255/ |
|---|
| Пользователь | KaranParelkar (UID 99714) |
|---|
| Представление | 24.09.2026 11:04 (18 дни назад) |
|---|
| Модерация | 11.10.2026 20:25 (17 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 416761 [code-projects Online Ticket Reservation System 1.0 /database/medallion.sql раскрытие информации] |
|---|
| Баллы | 20 |
|---|