Urgent: Unprotected Database Backup Exposes Sensitive Data in SourceCodester Simple Online Book Store System (CVE-2025-63891)

Overview

CVE-2025-63891 identifies a critical information disclosure vulnerability affecting the SourceCodester Simple Online Book Store System. This vulnerability allows an unauthenticated, remote attacker to retrieve the complete database contents, including schema and credential hashes, via a publicly accessible backup file. This poses a significant risk to the security and integrity of the application and its users’ data.

Technical Details

The vulnerability stems from the presence of a web-accessible database backup file (obs_db.sql) located within the /obs/database/ directory. Due to improper access controls, this file can be downloaded by anyone without requiring authentication. The database backup contains the full database schema, including tables, columns, and stored procedures, as well as potentially sensitive user data and password hashes used for authentication. The simple act of sending an HTTP GET request to /obs/database/obs_db.sql is sufficient to trigger the download.

CVSS Analysis

Currently, a CVSS score has not been assigned for CVE-2025-63891. However, given the severity of the information disclosure and the ease of exploitation, this vulnerability is likely to receive a HIGH to CRITICAL CVSS score once analyzed. The absence of authentication requirements and the potential for complete database compromise elevate the risk.

Possible Impact

The exploitation of CVE-2025-63891 can lead to severe consequences:

• Complete Database Compromise: The attacker gains access to all data stored in the database, including user information, book details, transaction history, and other sensitive data.
• Credential Theft: Password hashes (if not properly salted and hashed using strong algorithms) can be cracked, allowing attackers to gain unauthorized access to user accounts and administrative panels.
• Data Breach: The stolen data can be used for malicious purposes, such as identity theft, fraud, or blackmail.
• Reputational Damage: A successful attack can significantly damage the reputation of the organization using the vulnerable system.
• System Takeover: With database access, depending on database user privileges, it might be possible to execute arbitrary code on the server via SQL injection or other database features.

Mitigation and Patch Steps

Immediate action is required to mitigate this vulnerability:

1. Remove or Secure the Backup File: The obs_db.sql file should be immediately removed from the web-accessible directory. If the file is needed for backup purposes, it should be stored in a secure location outside the web root and protected with appropriate access controls.
2. Implement Access Controls: Restrict access to the /obs/database/ directory and any other sensitive directories or files using appropriate web server configurations (e.g., .htaccess for Apache, web.config for IIS).
3. Review Database Credentials: If you suspect the database has been compromised, immediately change the database credentials, including the root password and any other privileged user accounts.
4. Implement a Robust Backup Strategy: Establish a secure backup process that stores backups offsite or in a restricted-access environment. Encrypt the backups to prevent unauthorized access in case of a breach.
5. Contact SourceCodester: Contact SourceCodester and inform them of the vulnerability. Urge them to release a patched version of the Simple Online Book Store System.
6. Monitor for Suspicious Activity: Monitor your web server and database logs for any unusual activity that may indicate an attempted or successful exploit.

References

Simple.com (Placeholder – check if actual system URL available from SourceCodester)
SourceCodester
CVE-2025-63891 Details on GitHub