CVE-2025-63891
📋 TL;DR
This vulnerability allows remote unauthenticated attackers to access a web-accessible database backup file containing the complete database schema and credential hashes. Any organization using the vulnerable Simple Online Book Store System with the backup file exposed is affected.
💻 Affected Systems
- SourceCodester Simple Online Book Store System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including user credentials, personal information, and system configuration leading to credential cracking, data theft, and potential lateral movement.
Likely Case
Unauthenticated attackers download the database backup file, extract credential hashes for offline cracking, and access sensitive customer/book data.
If Mitigated
If proper access controls are implemented, attackers cannot reach the backup file, preventing data disclosure.
🎯 Exploit Status
Exploitation requires only a web browser or curl command to access the exposed SQL file.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://sourcecodester.com
Restart Required: No
Instructions:
1. Remove or move the obs_db.sql file from the web-accessible directory. 2. Ensure database backup files are stored outside web root. 3. Implement proper access controls for sensitive directories.
🔧 Temporary Workarounds
Remove exposed backup file
linuxDelete or move the database backup file from the web-accessible directory
rm /var/www/html/obs/database/obs_db.sql
mv /var/www/html/obs/database/obs_db.sql /secure/location/
Block access via web server configuration
allConfigure web server to deny access to database directory
Apache: <Directory /var/www/html/obs/database> Deny from all </Directory>
Nginx: location ~ ^/obs/database/ { deny all; }
🧯 If You Can't Patch
- Implement web application firewall rules to block requests to /obs/database/*
- Move database backup files to a non-web-accessible directory with proper permissions
🔍 How to Verify
Check if Vulnerable:
Attempt to access http://[target]/obs/database/obs_db.sql via browser or curl. If SQL file downloads, system is vulnerable.Check Version:
Check application version in admin panel or source code filesVerify Fix Applied:
Attempt to access the same URL after remediation - should receive 403/404 error or access denied.📡 Detection & Monitoring
Log Indicators:
- HTTP 200 GET requests to /obs/database/obs_db.sql
- Large file downloads from database directory
Network Indicators:
- Unusual GET requests to database backup file paths
- SQL file downloads from web servers
SIEM Query:
source="web_server" AND (url="/obs/database/obs_db.sql" OR url LIKE "%/database/%.sql") AND status=200