| 标题 | code-projects Matrimonial System IN PHP, CSS, JS, AND MYSQL 1.0 Information Disclosure |
|---|
| 描述 | A sensitive information disclosure vulnerability exists in the Code-Projects Matrimonial System in PHP, CSS, JS, and MySQL due to the inclusion of sensitive user information and plaintext credentials within the publicly accessible db/matrimony.sql database dump. The SQL file can be accessed without authentication through the application's /db/ directory and opened directly in a text editor, exposing user Personally Identifiable Information (PII), including dates of birth, gender, email addresses, and associated credential information. An unauthenticated attacker who can access the distributed project files may therefore obtain sensitive account data and potentially use exposed credentials to gain unauthorized access to affected accounts or application functionality. The issue is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).
CVSS: 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N — 7.5 (High)
Researchers Information
Researcher - 1
Name: Karan Parelkar
Independent Security Researcher
Email: [email protected]
GitHub: https://github.com/KaranParelkar
LinkedIn: https://www.linkedin.com/in/karan-parelkar-6a370125b/
Researcher – 2
Name: Abhishek Pisal
Independent Security Researcher
Email: [email protected]
GitHub: https://github.com/EvilGod108
LinkedIn: https://www.linkedin.com/in/abhishek-pisal-a358bb255/
Researcher – 3
Name: Gaurang Kalyankar
Independent Security Researcher
Email: [email protected]
Linkedin: https://www.linkedin.com/in/gaurang-kalyankar-cybersecurity/ |
|---|
| 来源 | ⚠️ https://github.com/KaranParelkar/Matrimonial_system_sqli/blob/main/Information%20Disclosure/Readme.md |
|---|
| 用户 | KaranParelkar (UID 99714) |
|---|
| 提交 | 2026-09-24 11時41分 (18 日前) |
|---|
| 管理 | 2026-10-11 20時27分 (17 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 416762 [code-projects Matrimonial System 1.0 db/matrimony.sql 权限提升] |
|---|
| 积分 | 20 |
|---|