Post #3134787
2024-01-19 09:23 UTC
@tklengyel@discuss.systems @WPalant@infosec.exchange @thisismissem@hachyderm.io Just connect to it with a GUI tool like dbeaver (like devs are likely to do), it will show you the schema of tables.
There will be columns like “clientName” or similar, and then doing a few very simple selects will tell you whether you have access to other people’s data.
Replies (2)
-
@Profpatsch@mastodon.xyz 2024-01-19 09:24
@tklengyel@discuss.systems @WPalant@infosec.exchange @thisismissem@hachyderm.io Mixing customer data like that and giving full access to the database with the given user credentials is criminal neglect and should cost the company dearly. Not the person who figured it out.
-
@WPalant@infosec.exchange 2024-01-19 09:34
@Profpatsch@mastodon.xyz @tklengyel@discuss.systems @thisismissem@hachyderm.io According to https://nitter.net/der_sofc/status/1747644600469127386 he connected with phpMyAdmin. While I haven’t used that tool in decades, that would presumably also expose the database schema immediately.