QiHang Media Web Digital Signage Cleartext Credential Disclosure Vulnerability

A cleartext credentials vulnerability has been identified in QiHang Media Web Digital Signage version 3.0.9. This vulnerability allows unauthenticated attackers to access administrative login information through an unprotected XML file. By requesting the '/xml/User/User.xml' file, attackers can retrieve hardcoded admin credentials, enabling direct authentication bypass.

Impact

Exploitation of this vulnerability leads to unauthorized access through authentication bypass, allowing attackers to log in as an administrator.

Reproduction

To reproduce this vulnerability, send a request for the '/xml/User/User.xml' file. This can be done using a web browser or a command-line tool like curl. The response will contain an XML file with administrative credentials in cleartext.