Administrative Credentials Disclosure

vendor:

phpvidz

by:

Michael Brooks

7,5

CVSS

HIGH

Credential Disclosure

200

CWE

Product Name: phpvidz

Affected Version From: 0.9.5

Affected Version To: 0.9.5

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

N/A

Administrative Credentials Disclosure

phpvidz does not use a SQL database. Instead it uses a system of flat files to maintain application state. The administrative password is stored within the following file and is included during runtime. Because this file has a .inc extension it is viewable by the attacker. To exploit this issue visit this url: http://localhost/phpvidz_0.9.5/includes/init.inc By default the password is the following constant: define ('ADMINPASSWORD' , '0000' ); This password can be used to login here (A username is not required): http://localhost/phpvidz_0.9.5/admin.php

Mitigation:

Ensure that sensitive information is not stored in plaintext files.

Source

Exploit-DB raw data:

Researcher: Michael Brooks
Affecting: phpvidz 0.9.5
Vulnerability: Administrative Credentials Disclosure
Vendor's Homepage: http://sourceforge.net/projects/phpvidz/

phpvidz does not use a SQL database. Instead it uses a system of flat
files to maintain application state. The administrative password is
stored within the following file and is included during runtime.
Because this file has a .inc extension it is viewable by the attacker.

To exploit this issue visit this url:
http://localhost/phpvidz_0.9.5/includes/init.inc
By default the password is the following constant:
define ('ADMINPASSWORD' , '0000' );
This password can be used to login here (A username is not required):
http://localhost/phpvidz_0.9.5/admin.php