GSA Bounty · Report #268382
Nginx misconfiguration leading to direct PHP source code download
Validstatus
highseverity
145upvotes
29 Jul 2019disclosed
How it was found
Poc: https://www.data.gov/app/plugins/saml-20-single-sign-on/saml/config/config.php