Access to SQL server of ubergreen.pt through password disclosure from different domain on same IP

Summary

The uber microsite http://ubergreen.pt has an open MYSQL port on 3306. ubergreen.pt itself is hosted on the IP 109.71.41.173. After some research, it was found that this IP also hosts many other domains. As of yesterday 11/10/18, this included the domain apps.etnos.co. This domain existed on the same IP as ubergreen.pt. Visiting apps.etnos.co led to the discovery of a zip file located at http://apps.etnos.co/outdarego.zip. This zip file contained a wordpress site files for another site that was hosted on the same IP as ubergreen.pt. In these files, the wp-config file contained the username and password for the MYSQL server for the IP. These credentials can then be used to log in successfully to the MYSQL server for ubergreen.pt. A screenshot of these credentials can be found attached to this report.

Thanks for disclosing this one Uber, this one shows that sometimes other domains that are OOS can lead to in-scope discoveries.

Check out my blog https://healdb.tech/blog/ or my Twitter https://twitter.com/heald_ben for some Bug Bounty tool releases and blogs!