silverstripe/framework's install.php script discloses sensitive data by pre-populating DB credential forms
When accessing the install.php script it is possible to extract any pre-configured database or default admin account password by viewing the source of the page, and inspecting the value property of the password fields.
| Software | From | Fixed in |
|---|---|---|
silverstripe / framework
|
4.0.0-rc1 | 4.0.1 |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime