Cleartext password exposure allows access to the desafio5estrelas.com admin panel

Summary

Vendor created and managed site desafio5estrelas.com exposes an administrator login password through the javascript source. This site was used by Uber in Portugal to encourage low-rated drivers to raise their ratings.This password allowed remote users access to the administrator panel of the site, which exposed data collected through the in-game surveys, as well as user IDs which can be used to log in as the user within this site.

Hard coded password for admin panel in the JavaScript file.

Check out my blog https://healdb.tech/blog/ or my Twitter https://twitter.com/heald_ben for some Bug Bounty tool releases and blogs!