Description

ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side database configuration and insufficient access control policies. Applications using publicly exposed database credentials or permissive database rules may allow unauthorised users to read, modify, or abuse stored form submission data. This could impact personally identifiable information (PII) submitted through the website contact form, including names, email addresses, phone numbers, and messages. The issue has been patched in version 1.0.1. Users unable to upgrade immediately can reduce risk by disabling public read/write database access, rotating exposed API keys, restricting database policies to authenticated requests only, moving sensitive operations to secure backend/serverless functions, and/or monitoring database activity logs for suspicious access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-11T18:17:34.013Z",
  "pubdate": "2026-08-11T18:17:34.013Z",
  "executiveSummary": "Prior to version 1.0.1, ishankportfolio suffers from an improper access control and misconfigured client-side database vulnerability that exposes contact form submissions to unauthorized external entities.\nThe vulnerability directly impacts personally identifiable information (PII) harvested through the website's contact form, including user names, email addresses, phone numbers, and message bodies.\nThe affected product is ishankportfolio in versions prior to 1.0.1.\nThe risk implications are severe, as exposed database credentials or excessively permissive security rules allow unauthenticated and unauthorized attackers to read, modify, or abuse stored submission data residing in the backend database.\nAttacker capabilities include extracting sensitive PII from victim submissions and potentially tampering with database integrity without requiring prior authentication or elevated privileges, provided the database rules permit public access.\nThe issue has been officially resolved in version 1.0.1, requiring administrators to update or manually harden their database configurations.",
  "technicalDetails": "The root cause of the vulnerability stems from improperly secured client-side database configurations coupled with insufficient access control policies implemented within ishankportfolio prior to version 1.0.1.\nThe vulnerable component involves the database integration layer, where overly permissive access rules and potentially exposed database credentials or API keys allow direct client-side interaction with the database storage mechanism.\nNetwork exposure is public, as the database rules and API endpoints are accessible over the internet without requiring authenticated user sessions.\nAuthentication and privilege requirements are absent for exploitation if default permissive rules are active, enabling anonymous, unauthenticated actors to interact with the database tables storing form submissions.\nThe attack flow proceeds as follows: First, an attacker inspects the client-side application source code or network traffic to identify exposed database credentials, API keys, or connection strings. Second, leveraging these exposed credentials or overly permissive read/write database rules, the attacker crafts direct queries or API requests to the database backend. Third, the database processes the unauthenticated requests due to the lack of sufficient access control policies. Finally, the attacker retrieves, modifies, or deletes stored records containing sensitive PII submitted by legitimate users via the contact form.\nPost-exploitation impact includes the mass harvesting of user PII, potential data corruption or deletion of contact submissions, and secondary exploitation vectors using harvested phone numbers and email addresses for targeted phishing or social engineering campaigns against website visitors."
}