SourceCodester Simple Online Book Store System Information Disclosure Vulnerability

A vulnerability allowing information disclosure has been identified in SourceCodester Simple Online Book Store System version 1.0. This issue arises from a web-accessible backup file that can be accessed via an unauthenticated HTTP GET request. The vulnerability allows remote attackers to retrieve the full contents of the database, including the schema and credential hashes.

Impact

Exploitation of this vulnerability leads to unauthorized access to sensitive database information, including user credentials.

Reproduction

To reproduce this vulnerability, send an unauthenticated HTTP GET request to '/obs/database/obs_db.sql' on the server where SourceCodester Simple Online Book Store System is hosted. The response will include the entire database contents, which can be saved as a .sql file.