[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

qdPM 9.2 - DB Connection String and Password Exposure (Unauthenticated) Vulnerability

Author
Leon Trappett
Risk
[
Security Risk Critical
]
0day-ID
0day-ID-36620
Category
web applications
Date add
04-08-2021
Platform
php
# Exploit Title: qdPM 9.2 - DB Connection String and Password Exposure (Unauthenticated)
# Exploit Author: Leon Trappett (thepcn3rd)
# Vendor Homepage: https://qdpm.net/
# Software Link: https://sourceforge.net/projects/qdpm/files/latest/download
# Version: 9.2
# Tested on: Ubuntu 20.04 Apache2 Server running PHP 7.4

The password and connection string for the database are stored in a yml file. To access the yml file you can go to http://<website>/core/config/databases.yml file and download.

#  0day.today [2024-12-24]  #