Description

A vulnerability has been found in SourceCodester Online Clothing Store 1.0. This affects an unknown part of the file /db/shopping.sql of the component SQL Database Backup. The manipulation leads to files or directories accessible. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-15T18:16:25.000Z",
  "pubdate": "2026-08-15T18:16:25.000Z",
  "executiveSummary": "An arbitrary file access vulnerability has been identified in SourceCodester Online Clothing Store version 1.0. The security flaw specifically resides within the SQL Database Backup component, involving direct interaction with the /db/shopping.sql file path. This vulnerability allows remote, unauthenticated attackers to bypass intended security boundaries and gain unauthorized read access to sensitive files or directories on the underlying host operating system.\nThe risk implications are severe, as unauthorized exposure of system files, database backups, and configuration data can lead to complete system compromise, credential theft, and further exploitation vectors. Remote exploitation is fully feasible because the attack surface is exposed over the network, and a functional exploit has already been disclosed to the public, significantly increasing the likelihood of active exploitation in the wild.\nNo specialized authentication or elevated privileges are explicitly required to initiate the attack vector, lowering the barrier to entry for malicious actors. Remediation requires strict input sanitization, proper access control enforcement, and removal or restriction of publicly accessible database backup files.",
  "technicalDetails": "The vulnerability stems from insufficient validation and sanitization of user-supplied input or direct predictable resource referencing within the SQL Database Backup component of the application. Specifically, the file path /db/shopping.sql is exposed without adequate access controls, path normalization, or authentication checks, allowing direct HTTP requests to retrieve the database backup file or traverse unauthorized directory structures.\nThe root cause is anchored in poor implementation of file handling and access restriction mechanisms within the web application architecture. When an HTTP request targets the vulnerable endpoint associated with /db/shopping.sql, the application fails to verify whether the requesting entity possesses authorized privileges to access sensitive database backup assets.\nThe attack flow proceeds as follows: First, a remote attacker identifies the network exposure of the target SourceCodester Online Clothing Store 1.0 deployment. Second, the attacker crafts an HTTP request directed at the vulnerable component managing the database backup file. Third, leveraging the lack of authentication and access validation, the application processes the request and directly returns the contents of /db/shopping.sql or permits traversal to adjacent files and directories.\nThe vulnerable component is the SQL Database Backup subsystem, impacting version 1.0 of the application. The attack vector is fully network-exploitable, requiring no prior authentication or administrative privileges. The post-exploitation impact includes the exposure of database schemas, table contents, administrative credentials, and personally identifiable information stored within the shopping.sql database dump, which facilitates secondary attacks such as authentication bypass or remote code execution."
}