CVE-2018-7251

Vulnerability

In Anchor CMS 0.12.3, the file config/error.php writes error logs to errors.log. This log file is accessible via the web at the /errors.log URI without authentication. When a MySQL error occurs (e.g., "Too many connections"), the error message includes the MySQL connection credentials, leading to exposure of the database username and password.

Exploitation

An attacker can exploit this by accessing the /errors.log endpoint on the affected Anchor CMS installation. If a MySQL error has been triggered (either by normal usage or by deliberately causing a database connection issue), the log file will contain the MySQL credentials. No authentication is required to read the log file.

Impact

Successful exploitation results in the disclosure of MySQL database credentials. An attacker with these credentials can connect to the database, potentially reading, modifying, or deleting data. This can lead to full compromise of the CMS data and underlying server if the database user has sufficient privileges.

Mitigation

The Anchor CMS project is no longer maintained ([3]). No official patch or fix has been released for CVE-2018-7251. The recommended workaround is to remove or restrict access to the errors.log file, or disable error logging entirely. As discussed in the GitHub issue ([4]), the error log should not be publicly accessible.