| 标题 | SourceCodester Online Clothing Store 1.0 Sensitive Information Disclosure |
|---|
| 描述 | A critical Sensitive Information Disclosure vulnerability was identified in the target web application due to a publicly accessible SQL database backup file. The backup file could be accessed and downloaded without any authentication or authorization, exposing the complete database contents.
The exposed SQL backup contained highly sensitive information, including administrator credentials, user account details, application data, and other confidential records. An unauthenticated attacker could download the backup, extract valid administrative credentials, and potentially gain unauthorized access to the application's administrative panel. This could result in complete compromise of the application, unauthorized data access, modification or deletion of records, and further attacks against the organization.
The root cause of this issue was the insecure storage of database backup files within a publicly accessible web directory, combined with the absence of proper access controls. Database backup files should never be accessible from the internet and must be securely stored outside the web root with appropriate access restrictions.
Security Impact: Critical |
|---|
| 来源 | ⚠️ https://medium.com/@hemantrajbhati5555/sensitive-information-disclosure-via-publicly-accessible-sql-backup-leading-to-administrative-50bac3a307aa |
|---|
| 用户 | Hemant Raj Bhati (UID 95613) |
|---|
| 提交 | 2026-06-26 13時57分 (2 月前) |
|---|
| 管理 | 2026-08-14 21時27分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 390096 [SourceCodester Online Clothing Store 1.0 SQL Database Backup /db/shopping.sql 权限提升] |
|---|
| 积分 | 20 |
|---|