HexBrain

U.S. Dept Of Defense · Report #1631471

an internel important paths disclosure [HtUS]

Validstatus
mediumseverity
2upvotes
14 Sept 2022disclosed

How it was found

Summary:

i found CGI script environment variable disclosure an important paths

Steps To Reproduce:

  1. visit this link : https://███
  2. look at poc pic

you should restrict this quickly

Impact

this is so dangerous because attacker now know an internal paths and this juicy information as u can see in poc pic he know now the mysql path , openssl config server admin and more ... etc

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original