HexBrain

MTN Group · Report #817331

Weak/Auto Fill Password

Validstatus
criticalseverity
53upvotes
3 Sept 2022disclosed

Summary

Pure luck!!! - admin/admin All login page ==MUST== be tested with admin/admin & root/root.

How it was found

Summary:

https://mtnc-selfservice.mtncameroon.net

The following url has admin/admin as user name and password

Steps To Reproduce:

  1. open the url in any browser of your choice
  2. enter admin as user name and password
  3. booom .... full asset to super admin full panel

Supporting Material/References:

See attached screenshots

Impact

Attacker can make major configuration changes to the services.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original