Complete Admin account takeover due to PhpDebugBar turned on in Uber's production server

Summary

The #1883806 report was reported to Uber on February 22, 2023. The application in question disclosed credentials through PhpDebugBar - the researcher was able to login to the application using the exposed creds. After discussing this internally, we determined that the impact to Confidentiality and Integrity is Low because the instance is in the developing process. Additionally, no real data inside the platform was found and the platform is not connected to production services therefore having Admin access to the instance does not translate to Confidentiality and Integrity impact.