U.S. Dept Of Defense · Report #883693
Information Disclosure(PHPINFO/Credentials) on DoD Asset
Summary
A Department of Defense(DoD) asset leaked the systems' PHPInfo page which contained sensitive information such as Active Directory credentials. This may have led to System Compromise. The DoD Representatives were responsive and thorough when handling my report.
How it was found
Summary: A DoD leaks credentials on a phpinfo() page.
Description: https://███ publicly displays a phpinfo() page that leaks system information and credentials.
Impact
The impact is medium not only due to information leakage of numerous different details such as system information but also the leakage of domain credentials. USERDOMAIN ███████ USERNAME ██████ █████████PASSWORD'] ████████
Step-by-step Reproduction Instructions
- Visit: https://████/████
- Information Disclosed
Suggested Mitigation/Remediation Actions
████████ BAT suggests removing the ███ page or requiring authentication before making it accessible.
Impact
The impact is medium not only due to information leakage of numerous different details such as system information but also the leakage of domain credentials.