ASTPP Information Disclosure Vulnerability Allowing Unauthenticated Database Backup Download

A vulnerability in ASTPP version 4.0.1 allows unauthenticated attackers to access sensitive database information by downloading database backup files. This is achieved by predicting the filename patterns of the backups. Attackers can generate combinations of 6-digit PINs and use them to fuzz the backup download URLs, extracting confidential data from the '/database_backup/' directory.

Impact

Exploitation of this vulnerability leads to unauthorized access to sensitive database information.

Reproduction

To reproduce this vulnerability, first generate a list of 6-digit PIN combinations. Then, fuzz the backup download URL by replacing the PIN in the filename with one from the generated list. If successful, the response will indicate the backup file is available for download.