Elunez Eladmin Druid Default Credentials Vulnerability

A default credentials vulnerability has been identified in Elunez Eladmin versions through 2.7, specifically within the Druid component. The issue arises from hardcoded login credentials in the application-prod.yml configuration file. This vulnerability allows remote attackers to access sensitive operational information by exploiting the default username and password, which are publicly known.

Impact

Exploitation of this vulnerability allows unauthorized users to access the Druid management interface using default credentials, potentially leading to unauthorized data access or manipulation.

Reproduction

To reproduce this vulnerability, access the Druid login page on a server running Elunez Eladmin version 2.7 or earlier. Use the default credentials: username 'admin' and password '123456'.