Executive brief
The Vehicle Management System is a PHP-based application used to manage vehicle-related data and operations. A critical flaw allows remote attackers to access a sensitive SQL database backup file (.sql) that is exposed in the public web directory, potentially revealing database contents including usernames, passwords, and other confidential information without requiring any authentication.
Technical details
The vulnerability is an insecure file handling issue (CWE-434 / CWE-538) in which SQL database backup files are left in the web root directory and are directly accessible via HTTP requests. The vulnerable component is the SQL Database Backup File Handler; an attacker can craft a simple GET request to /vehicle_management.sql to retrieve the entire database backup. No authentication is required and the attack vector is network-based. The root cause is improper deployment practices leaving sensitive backup files unprotected. An attacker can download the SQL file to obtain database credentials, user data, and internal system information, potentially leading to further compromise. Mitigation requires removing SQL files from the public web root and implementing proper access controls.
Affected products
- code-projects Vehicle Management System 1.0
Timeline
- 2026-09-04: disclosed
- other: Exploit published and available