Executive Summary

This vulnerability exists in Open ISES Tickets versions before 3.44.2, where hardcoded MySQL database credentials are present in the file loader.php, which is a public-facing database utility.

Because these credentials are committed to the source repository, any actor who can access the public source tree or an unauthenticated attacker who can read the file on a deployed installation can obtain the username, password, and database name.

If the database is reachable from the attacker's network, they can use these credentials to connect to the database.

Useful 0 Not Useful 0

Impact Analysis

An attacker who obtains the hardcoded database credentials can connect to the database if it is accessible from their network.

This can lead to unauthorized access to sensitive data stored in the database, potentially resulting in data theft, data manipulation, or disruption of services.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability exposes hardcoded MySQL database credentials in a public-facing file, allowing unauthorized actors to access sensitive database information if the database is reachable. Such unauthorized access to sensitive data can lead to violations of data protection regulations like GDPR and HIPAA, which mandate strict controls over access to personal and health information.

By enabling potential unauthorized database access, this vulnerability increases the risk of data breaches, which can result in non-compliance with these standards and regulations, potentially leading to legal and financial penalties.

Useful 0 Not Useful 0