Pop Under Ads Network version 1.0 discloses MySQL credentials in html source code.
b61df52b0185ea6b9e4036666b505dc6b4b1381807797cebe5c6b71b04558560
| # Title : pop under ads network v1.0 MySQL connection credentials Vulnerability
| # Author : indoushka
| # email : indoushka4ever@gmail.com
| # Tested on : windows 8.1 FranASSais V.(Pro)
| # Version : 1.0
| # Vendor : http://dl.20script.ir/script/ads/20S-pop-under-ads-network-v1.0[www.20script.ir].zip
========================================================================
Vulnerability description :
For a client program to be able to connect to the MySQL server,
it must use the proper connection parameters,
such as the name of the host where the server is running and
the user name and password of your MySQL account.
This file contains full/partial source code that contains
a mysql_connect/mysql_pconnect function call that includes
the MySQL connection credentials. This information
is highly sensitive and should not be found on a production system.
poc :
1 - right click and open the page source .
2 - http://b.top4top.net/p_201kowq1.jpg
Greetz :----------------------------------------------------------------
|
jericho * Larry W. Cashdollar * moncet-1 * achraf.tn |
|
========================================================================