| tiêu đề | code-projects Student Crud Operation In PHP 1.0 Information Disclosure |
|---|
| Mô tả | Student CRUD Operation in PHP contains a Sensitive Information Disclosure vulnerability due to the presence of a publicly accessible SQL database file named card_activation.sql.
The affected database resource is located at:
/Student-Registration-Crud-Operation/card_activation.sql
The vulnerability occurs because the SQL file is placed within a directory served directly by the web server without sufficient access restrictions.
An attacker does not need to exploit SQL injection, bypass application functionality, or manipulate application parameters to access the affected resource. Instead, the attacker can directly request the predictable SQL filename through HTTP.
If the web server returns the resource, the attacker obtains the SQL dump without passing through the application's intended access-control mechanisms.
SQL database dumps commonly contain statements used to recreate the application's backend database. Depending on the contents of card_activation.sql, the disclosed information may include database table definitions, column names, relationships, application records, account information, configuration values, or other information maintained by the application.
If user records or authentication information are present, exposure could further disclose usernames, email addresses, password hashes or improperly stored passwords, and other account-related information. Such data categories should only be listed as confirmed impact if they are actually present in the exposed file.
Even when the dump contains only database schema information, disclosure provides an attacker with detailed knowledge of the application's internal database architecture. This information can assist in identifying table names, sensitive columns, relationships between application components, and potentially vulnerable database operations.
The vulnerability therefore represents an insecure deployment and information exposure issue in which a database resource that should remain private is made accessible through the public web interface.
|
|---|
| Nguồn | ⚠️ https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Student%20CRUD%20Operation%20in%20PHP%20%E2%80%93%20Sensitive%20Information%20Disclosure%20via%20Exposed%20%60card_activation.sql%60%20Database%20File.md |
|---|
| Người dùng | AhmadMarzouk (UID 95993) |
|---|
| Đệ trình | 29/07/2026 18:44 (cách đây 1 tháng) |
|---|
| Kiểm duyệt | 07/09/2026 21:29 (1 month later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 399673 [code-projects Student Crud Operation 1.0 Backup File /card_activation.sql tiết lộ thông tin] |
|---|
| điểm | 20 |
|---|