Administrative access to development deployment of web service due to auto-filled credentials

Summary

It was possible to gain administrative permissions on https://admin.acronis.host due to auto-filled credentials. The service was used for development purposes only and did not contain any sensitive data or data of real users.

Summary: I discovered an Acronis admin panel which auto filled credentials. This allowed me to gain access multiples databases and get an authentication token for the internal API.

Username:[email protected]
Password:password

I was able to discover an SQL injection and authenticate myself on dev.acronis.host (which is the internal API). Example request:

GET /api/admin/pages?page=1&limit=100&sort=%2Btype&filter=%7B%7D&search= HTTP/1.1
Host: dev.acronis.host
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Authorization: Bearer {token}
Origin: https://admin.acronis.host
Connection: close
Referer: https://admin.acronis.host/dev.acronis.host/en-US/products/4372

Further analysis concluded that data was development and no real users were affected. Acronis is a great team and I look forward to working with them in the future.