Login Registration System
Monthly
Direct HTTP access to an exposed SQL database backup file in code-projects Login Registration System 1.0 allows unauthenticated remote attackers to download the raw database dump at /loginsystem/database/login_registration_system.sql, disclosing user credentials, schema details, and any sensitive data stored in the application database. This is a CWE-552 file exposure defect - the backup artifact is stored within the web-accessible document root with no access controls. No exploitation beyond a standard HTTP GET request is required. A public proof-of-concept exploit exists; no KEV listing at time of analysis.
Direct HTTP access to an exposed SQL database backup file in code-projects Login Registration System 1.0 allows unauthenticated remote attackers to download the raw database dump at /loginsystem/database/login_registration_system.sql, disclosing user credentials, schema details, and any sensitive data stored in the application database. This is a CWE-552 file exposure defect - the backup artifact is stored within the web-accessible document root with no access controls. No exploitation beyond a standard HTTP GET request is required. A public proof-of-concept exploit exists; no KEV listing at time of analysis.