[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    [FD] Bagisto: Insecure installation in sub-directories
From:       devsecweb--- via Fulldisclosure <fulldisclosure () seclists ! org>
Date:       2020-08-29 15:49:12
Message-ID: 8c144956a28f9760b319e587fd6675fc () mail ! privatemail ! com
[Download RAW message or body]

Vendor:
Bagisto (https://bagisto.com/)
Affected version:
All
Introduction:
	Bagisto is an open source shop system based on PHP and Laravel framework
	Vulnerability description:
Bagisto can be installed in sub-directories below the document root exposing the Laravel .env \
file which includes database and e-mail server credentials.

Proof:
There have been observed installations in the wild exposing the .env file like \
https://klingbakeshop.com/public/ (https://klingbakeshop.com/public/)

Solution:
The "public" directory must be configured as document root of the web server
Sent with PrivateMail

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/


[prev in list] [next in list] [prev in thread] [next in thread]