Executive brief
A PHP login and registration system makes its database backup file publicly accessible via the web. An attacker can download the entire SQL dump without authentication, exposing user names, email addresses, and plaintext passwords. This allows credential theft, account takeover, and enumeration of valid user accounts for further attacks.
Technical details
The vulnerability is an information disclosure flaw (CWE-200, CWE-548) affecting the Login Registration System PHP 1.0. The application stores an unencrypted SQL database dump file at `/loginsystem/database/login_registration_system.sql` in a web-accessible directory with directory listing enabled. An unauthenticated attacker can remotely access and download this file over HTTP/HTTPS without any credentials or user interaction. The SQL dump contains complete user records including plaintext passwords, email addresses, and names. There is no authentication or authorization check on the backup file. Remediation requires removing SQL files from the web root, disabling directory listing, implementing proper access controls, and hashing passwords with strong algorithms such as `password_hash()`.
Affected products
- code-projects.org Login Registration System In PHP 1.0
Timeline
- 2026-08-20: disclosed