| Title | itsmeravitejak Online-Examination-System e6208e630b14657999bbfe4c9912302d2a1e2449 Storage of File with Sensitive Data Under Web Root |
|---|
| Description | The affected component is the web root of the application, which ships and serves sensitive files: `dbtables.sql` (the full database dump used by the documented installation procedure) and the PHP source backups `exam-ajax.php.backup` and `disp.php.backup`, plus `include/database - Copy.php`. Because these files live inside the document root and have non-PHP extensions (or are static), the web server delivers their raw contents to any visitor without authentication. `dbtables.sql` contains the `users` table with the MD5 password hashes of the default accounts, the administrator's fixed `userid` session token (`d3f0b93bf63fefad081eb1f2cbb59d10` - which alone enables the cookie-based authentication bypass reported separately), email addresses and the full schema. The `.backup` files disclose the application source code of the exam AJAX flow.
|
|---|
| Source | ⚠️ https://github.com/itsmeravitejak/Online-Examination-System/issues/9 |
|---|
| User | yunshen (UID 100191) |
|---|
| Submission | 09/28/2026 19:18 (22 days ago) |
|---|
| Moderation | 10/14/2026 15:55 (16 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 419855 [itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449 dbtables.sql information disclosure] |
|---|
| Points | 20 |
|---|