| 标题 | SourceCodester Online Clothing Store 1.0 Information Disclosure |
|---|
| 描述 | An Information Disclosure vulnerability was discovered in an Online Clothing Store application due to exposed Dreamweaver metadata files and enabled directory listing. The web server improperly exposes development-related files, including Dreamweaver synchronization files such as dwsync.xml, which can be accessed without authentication.
An attacker can remotely access these files to obtain information about the website structure, file locations, and development artifacts. Furthermore, directory listing is enabled on certain directories, allowing unauthorized users to enumerate files and folders that were not intended for public access.
The disclosed information may assist attackers in identifying hidden resources, backup files, administrative paths, and other sensitive components of the application. This information can be used for further reconnaissance and may increase the likelihood of successful attacks against the affected system.
The vulnerability does not require authentication and can be exploited remotely using a standard web browser. The issue arises from improper server configuration and inadequate protection of development-related files.
Impact:
- Information Disclosure
- File and Directory Enumeration
- Exposure of Development Artifacts
- Internal Structure Disclosure
- Increased Attack Surface
Affected Component:
Exposed Dreamweaver Metadata Files (dwsync.xml) and Directory Listing Functionality |
|---|
| 来源 | ⚠️ https://medium.com/@hemantrajbhati5555/information-disclosure-via-exposed-dreamweaver-metadata-files-and-directory-listing-5651ebcaef97 |
|---|
| 用户 | Hemant Raj Bhati (UID 95613) |
|---|
| 提交 | 2026-06-21 16時59分 (2 月前) |
|---|
| 管理 | 2026-08-07 12時39分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 386993 [SourceCodester Online Clothing Store Dreamweaver Metadata Files /_notes/ 信息公开] |
|---|
| 积分 | 20 |
|---|