BOOK THIS SPACE FOR AD
ARTICLE ADOverview of the Vulnerability:
This security vulnerability occurs when unauthorized individuals gain direct access to an admin dashboard by exploiting leaked or exposed credentials. Such credentials could be compromised through various means, including data breaches, phishing attacks, or inadequate password management practices. This bug is critical as it provides attackers with administrative privileges, allowing them to manipulate sensitive data, alter system settings, and potentially compromise the entire application or system.
Steps:
While I was inspecting the normal flow of the application, and reading every source code of every page that came across, I found something interesting in the JavaScript code on the same page.
APPD_SERVICE_USER":"[Redacted]@msrv.appdynamics.com","APPD_SERVICE_PWD":"[Redacted]"""CCI_IDP_ID":"[Redacted]","APPD_DOCEBO_USERNAME":"[Redacted]-admin@appdynamics.com","APPD_DOCEBO_PASSWORD":"[Redacted]","LAUNCH_DARKLY_CLIENT_ID":"[Redacted]","SMARTLOOK_CLIENT_ID":"[Redacted]"
Just log in and go to the admin Dashboard :)