Exposure Of Admin Username & Password

How it was found

Hello Team, Ther an exposure of your username and password on this subdomain █████

uid: "mtnng",
    passwd: "██████████",

Steps To Reproduce:

Visit ███

Now, press CTRL+U to view the source code of this page,

Look for this code

   console.log(message);
}

}

(function (){
const plid = 73;

const mtnContainer = document.getElementById("mtn20238");
const mtnUri = mtnContainer.childNodes[0].getAttribute("href");
mtnContainer.addEventListener("click", ()=>fetch(mtnUri).catch(()=>{}));

window.mobucksApi.placeAd({
    containerElementId: "mtn20238",
    uid: "mtnng",
    passwd: "███████",
    plid:plid,
    }, () => { 
        typeof mtnNoBanner == "function" && mtnNoBanner(plid,mtnContainer);

Impact

The exposed password is in md5 which I was able to decrypt easily

uid: mtnng hash = bd31568138edbfc0552a1ecc6886ea plain password: ███

And as an attacker, this can be abused in lots of ways such as exposing some client's info

████