MTN Group · Report #817331
Weak/Auto Fill Password
Validstatus
criticalseverity
53upvotes
3 Sept 2022disclosed
Summary
Pure luck!!! - admin/admin All login page ==MUST== be tested with admin/admin & root/root.
How it was found
Summary:
https://mtnc-selfservice.mtncameroon.net
The following url has admin/admin as user name and password
Steps To Reproduce:
- open the url in any browser of your choice
- enter admin as user name and password
- booom .... full asset to super admin full panel
Supporting Material/References:
See attached screenshots
Impact
Attacker can make major configuration changes to the services.