CVE-2025-63891: Book Store System Info Disclosure Flaw

CVE-2025-63891 Overview

CVE-2025-63891 is an Information Disclosure vulnerability affecting the SourceCodester Simple Online Book Store System. The vulnerability exists due to a web-accessible backup file that allows remote unauthenticated attackers to disclose full database contents, including schema information and credential hashes, via an unauthenticated HTTP GET request to /obs/database/obs_db.sql.

This vulnerability represents a critical security misconfiguration where sensitive database backup files are exposed through the web server without any authentication or access controls. Successful exploitation provides attackers with complete visibility into the application's database structure and stored credentials, potentially enabling further attacks such as credential cracking and unauthorized system access.

Critical Impact

Unauthenticated attackers can retrieve complete database backups containing sensitive user credentials, schema information, and application data without any authentication.

Affected Products

• SourceCodester Simple Online Book Store System version 1.0
• oretnom23 simple_online_book_store_system

Discovery Timeline

• 2025-11-14 - CVE-2025-63891 published to NVD
• 2025-11-19 - Last updated in NVD database

Technical Details for CVE-2025-63891

Vulnerability Analysis

This vulnerability falls under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The Simple Online Book Store System stores database backup files in a publicly accessible directory within the web root. The backup file located at /obs/database/obs_db.sql contains a complete SQL dump of the application database, which includes table structures, user account information, and hashed passwords.

The exploitation mechanism is straightforward: an attacker simply needs to craft an HTTP GET request to the predictable backup file path. No authentication tokens, session cookies, or special headers are required. The web server serves the SQL file as a downloadable resource, exposing the entire database contents to anyone who knows or discovers the file path.

The network-accessible nature of this vulnerability means any attacker with HTTP access to the application can exploit it. The low attack complexity combined with no required privileges or user interaction makes this vulnerability particularly dangerous for internet-facing deployments.

Root Cause

The root cause of this vulnerability is improper access control configuration on sensitive backup files. The application stores database backup files within the web-accessible directory structure without implementing any authentication checks or access restrictions. This design flaw violates the principle of least privilege and exposes highly sensitive information to unauthorized users.

Common contributing factors to this type of vulnerability include:

• Storing backup files within the document root instead of a protected location
• Missing .htaccess or equivalent web server access controls
• Absence of file extension restrictions for sensitive file types
• Failure to implement authentication middleware for sensitive directories

Attack Vector

The attack vector for CVE-2025-63891 is network-based and requires no authentication. An attacker can exploit this vulnerability by performing the following:

1. Discovery Phase: The attacker identifies the target application as SourceCodester Simple Online Book Store System through fingerprinting or reconnaissance
2. Exploitation: The attacker sends an unauthenticated HTTP GET request to the predictable path /obs/database/obs_db.sql
3. Data Extraction: The web server returns the complete SQL database backup file
4. Post-Exploitation: The attacker extracts credential hashes from the dump and attempts offline password cracking, or uses the schema information to craft additional attacks such as SQL injection

The attack can be executed using any HTTP client, including web browsers or command-line tools like curl or wget. The predictable file naming convention makes this vulnerability trivially discoverable through manual testing or automated scanning.

Detection Methods for CVE-2025-63891

Indicators of Compromise

• HTTP GET requests targeting /obs/database/obs_db.sql or similar database backup paths
• Unusual access patterns to the /obs/database/ directory from external IP addresses
• Web server logs showing successful (HTTP 200) responses for .sql file requests
• Large outbound data transfers associated with database file downloads

Detection Strategies

• Implement web application firewall (WAF) rules to block requests for .sql file extensions in web-accessible directories
• Configure web server access logging and monitor for requests to /obs/database/ paths
• Deploy file integrity monitoring on backup directories to detect unauthorized access or modifications
• Use network monitoring to detect large file transfers from backup file paths

Monitoring Recommendations

• Enable detailed access logging on the web server to capture all requests to the application
• Set up alerts for any HTTP requests matching patterns like *.sql, *.bak, or *.dump in web directories
• Monitor for reconnaissance activity such as directory enumeration attempts against /obs/ paths
• Review authentication logs for post-exploitation activity following potential database credential compromise

How to Mitigate CVE-2025-63891

Immediate Actions Required

• Remove or relocate the obs_db.sql backup file from the web-accessible /obs/database/ directory immediately
• Block access to the /obs/database/ directory using web server configuration rules
• Rotate all credentials stored in the potentially exposed database backup
• Review web server access logs for evidence of prior exploitation

Patch Information

No official vendor patch has been identified for this vulnerability. Organizations should implement the workarounds and mitigations described below to protect against exploitation. Additional technical details may be available at the GitHub CVE-2025-63891 Details page.

For reference, the affected product information is available on SourceCodester.

Workarounds

• Move all database backup files outside of the web document root to a location not accessible via HTTP
• Configure web server rules (such as .htaccess for Apache) to deny access to .sql files and backup directories
• Implement authentication requirements for any administrative directories that must remain web-accessible
• Consider using application-level access controls or IP whitelisting for sensitive file paths

# Apache .htaccess configuration to block SQL file access
<FilesMatch "\.(sql|bak|dump)$">
    Require all denied
</FilesMatch>

# Block access to database directory
<Directory "/var/www/html/obs/database">
    Require all denied
</Directory>