From Debug page to Database access

Hello guys, I hope everything is well.
Today, I will explain how I got access to the database from the debug page.

When I was doing some recon, I found a weird domain inside the source page of one of the main websites in my target. So, when I opened it, I saw a Laravel debug page.
This debug page disclosed database credentials.

But this was not enough to report it as a valid issue, so I downloaded a program on my PC called DBeaver.
This program allows you to connect to any type of database, view all information, and edit it.

So, after using the credentials and connecting, yeah, it’s valid! Now, I can see everything in the database, like emails, passwords, cookie values, PII, and even edit configurations.

After reporting it, I also did subdomain enumeration on the main domain and found another vulnerable website with the same bug. However, it was a test environment. But it’s okay — they gave a 25% bonus for it!

And that’s all for today.
Thanks for reading!