webERP Unauthenticated Backup File Access Vulnerability

A vulnerability in webERP version 4.15.1 allows remote attackers to access and download database backup files without authentication. The issue arises from unauthenticated file access in the 'companies/weberp/' directory, where generated backup files can be directly accessed by requesting them via their timestamped filenames. This vulnerability is classified under CWE-552, which pertains to files or directories accessible to external parties.

Impact

Exploitation of this vulnerability allows for unauthorized access to sensitive database backup files, which could contain confidential information.

Reproduction

To reproduce this vulnerability, upload a database backup file using the 'BackUpDatabase.php' file. Once the backup is created, it can be downloaded from the 'companies/weberp/' directory by requesting the file named 'Backup_[timestamp].sql.gz'.