CVE-2023-49980
📋 TL;DR
This vulnerability allows unauthenticated attackers to list directories and access sensitive files in Best Student Result Management System v1.0. Anyone running this specific PHP web application is affected, potentially exposing configuration files, database credentials, and other sensitive data.
💻 Affected Systems
- Best Student Result Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain database credentials, compromise the database, access student records, and potentially achieve remote code execution through exposed configuration files.
Likely Case
Attackers enumerate directory structures, download sensitive files including configuration files with database credentials, and potentially access student data.
If Mitigated
With proper access controls and directory restrictions, impact is limited to information disclosure about directory structure without sensitive file access.
🎯 Exploit Status
Simple directory traversal via crafted URLs. No authentication required. Public exploit code available on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider replacing with alternative software or implementing workarounds.
🔧 Temporary Workarounds
Disable Directory Listing
allConfigure web server to prevent directory listing
For Apache: Add 'Options -Indexes' to .htaccess or httpd.conf
For Nginx: Add 'autoindex off;' to server block
Restrict Access to Sensitive Directories
allBlock access to configuration and sensitive directories
For Apache: 'Deny from all' in .htaccess for sensitive directories
For Nginx: 'location ~ /\.(ht|env|config) { deny all; }'
🧯 If You Can't Patch
- Move application behind authentication gateway or VPN
- Implement web application firewall rules to block directory traversal patterns
🔍 How to Verify
Check if Vulnerable:
Access URLs like http://target/directory/ to see if directory listing is enabled without authenticationCheck Version:
Check application files for version information, typically in README or configuration filesVerify Fix Applied:
Attempt directory listing after implementing workarounds - should return 403 Forbidden or similar error📡 Detection & Monitoring
Log Indicators:
- Multiple 200 OK responses to directory paths without file extensions
- Patterns of ../ or directory traversal attempts in access logs
Network Indicators:
- HTTP requests ending with / or without file extensions returning directory listings
SIEM Query:
web.url="*/" AND web.status="200" AND NOT web.url="*.php" AND NOT web.url="*.html"🔗 References
- https://github.com/geraldoalcantara/CVE-2023-49980
- https://www.sourcecodester.com/php/15653/best-student-result-management-system-project-source-code-php-and-mysql-free-download
- https://github.com/geraldoalcantara/CVE-2023-49980
- https://www.sourcecodester.com/php/15653/best-student-result-management-system-project-source-code-php-and-mysql-free-download
