SourceCodester Best Employee Management System backups.php information disclosure

Vulnerability

The vulnerability exists in SourceCodester Best Employee Management System version 1.0, specifically in the file /admin/backup/backups.php. The code does not properly restrict access, leading to information disclosure. The attack can be initiated remotely without authentication. The issue was disclosed publicly [1].

Exploitation

An attacker can exploit this vulnerability by sending a direct HTTP request to /admin/backup/backups.php. No authentication or special privileges are required. The exploit details have been published [1], making it easy to replicate.

Impact

Successful exploitation allows an attacker to view sensitive information, such as backup files or database contents, leading to information disclosure. The confidentiality of the system is compromised.

Mitigation

The vendor was contacted but did not respond [2]. As of the publication date (2025-02-24), no official patch or fix is available. Users should restrict access to the vulnerable file via web server configuration or disable the backup functionality until a fix is released.