PHP Webquest MySQL Credentials Information Disclosure Vulnerability

Bugtraq ID:	27202
Class:	Design Error
CVE:	CVE-2008-0249
Remote:	Yes
Local:	Yes
Published:	Jan 09 2008 12:00AM
Updated:	May 07 2015 05:33PM
Credit:	MhZ91 discovered this issue.
Vulnerable:	PHP Webquest PHP Webquest 2.6
Not Vulnerable:

PHP Webquest MySQL Credentials Information Disclosure Vulnerability

PHP Webquest is prone to an information-disclosure vulnerability because it fails to protect the MySQL database credentials.

Attackers can exploit this issue to gain unauthorized access to the affected database and then manipulate or delete sensitive information.

PHP Webquest 2.6 is vulnerable; other versions may also be affected.

PHP Webquest MySQL Credentials Information Disclosure Vulnerability

To exploit this issue, attackers can use a browser.

The following example URI is available:

http://www.example.com/admin/backup_phpwebquest.php

PHP Webquest MySQL Credentials Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

PHP Webquest MySQL Credentials Information Disclosure Vulnerability

References:

• PHP Webquest Homepage (PHP Webquest)