Vue Vben Admin Hardcoded Credentials Vulnerability Allowing Unauthorized Backend Login

A vulnerability in Vue Vben Admin version 2.10.1 allows unauthorized access to the backend due to hardcoded credentials. This issue can be exploited by retrieving the embedded login information from the JavaScript source code of the application.

Impact

Exploitation of this vulnerability allows for unauthorized login to the backend, potentially leading to unauthorized access to sensitive data or administrative functions.

Reproduction

To reproduce this vulnerability, access the login page of the affected Vue Vben Admin application. Right-click to view the source code and search for the 'index' JavaScript file. The hardcoded login credentials can be found in this file. Once the credentials are identified, use them to log into the system. This vulnerability can also be verified in bulk using the Fofa search engine by searching for the hardcoded icon hash.