| 标题 | Webkul Aureus ERP v1.6.0 Information Disclosure |
|---|
| 描述 | AureusERP v1.6.0 is affected by an information disclosure vulnerability caused by an insecure debug configuration and production packaging. The application ships with APP_DEBUG=true in its .env.example and .env.pgtest configuration files, while barryvdh/laravel-debugbar is included as a production dependency in composer.json rather than being restricted to development dependencies. When the application is deployed without explicitly disabling debug mode, the Laravel Debugbar is exposed to users and discloses sensitive internal application information, including server-side filesystem paths, HTTP request and response headers, PHP and framework versions, environment and debug status, raw SQL queries with bound data, session-related values, and request history. This information is accessible through the application's web interface and does not require authentication when debug mode is enabled, potentially providing attackers with sensitive implementation details and information useful for reconnaissance and exploitation of additional vulnerabilities. The issue is particularly significant because the insecure debug configuration is shipped with the product, meaning deployments that fail to override the setting may unintentionally expose this information in production environments. |
|---|
| 来源 | ⚠️ https://github.com/KaranParelkar/Auresus_vulnerability/blob/main/Information_Disclosure/Readme.md |
|---|
| 用户 | Devansh33 (UID 101178) |
|---|
| 提交 | 2026-09-11 15時27分 (1 月前) |
|---|
| 管理 | 2026-10-19 11時26分 (1 month later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 422295 [Webkul Aureus ERP 直到 1.6.0 composer.json 信息公开] |
|---|
| 积分 | 20 |
|---|