Bagisto Credential Disclosure

As of 2020/09/01, all versions of Bagisto appear to leak database and email server credentials in the document root.


MD5 | 7fc061d5cf8581a756c5a61f9a15896f

Download
Vendor:
Bagisto (https://bagisto.com/)
Affected version:
All
Introduction:
  Bagisto is an open source shop system based on PHP and Laravel framework
  Vulnerability description:
Bagisto can be installed in sub-directories below the document root exposing the Laravel .env file which includes database and e-mail server credentials.

Proof:
There have been observed installations in the wild exposing the .env file like https://klingbakeshop.com/public/ (https://klingbakeshop.com/public/)

Solution:
The "public" directory must be configured as document root of the web server
Sent with PrivateMail



Source: packetstormsecurity.com
Related Posts