CVE-2026-14808: Prog Management System Info Disclosure

CVE-2026-14808 Overview

CVE-2026-14808 is a sensitive information exposure vulnerability [CWE-497] in the Prog Management System developed by PROG MIS. The flaw allows unauthenticated remote attackers to access a specific web page and retrieve the database account and password stored by the application. Because no authentication or user interaction is required, attackers can harvest database credentials directly over the network. Compromised credentials provide direct access to the backend database, exposing all stored records to disclosure, modification, or deletion.

Critical Impact
Unauthenticated remote attackers can retrieve database credentials from an exposed page, granting full read/write access to the backend database.

Affected Products

Prog Management System by PROG MIS

Discovery Timeline

2026-07-06 - CVE-2026-14808 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14808

Vulnerability Analysis

The Prog Management System exposes a page that returns the database account name and password to any requester. The application fails to enforce authentication or access control on this resource, treating a sensitive configuration endpoint as publicly reachable content. Attackers who identify the URL can retrieve the credentials in a single HTTP request. Once obtained, the credentials permit direct connections to the backing database server, bypassing all application-layer authorization checks.

Root Cause

The vulnerability is classified under [CWE-497] Exposure of Sensitive System Information to an Unauthorized Control Sphere. The application does not restrict which users can view an internal page that renders configuration data, and the database credentials are embedded within that response. The design flaw combines improper access control with plaintext exposure of secrets that should never be reachable from the network perimeter.

Attack Vector

Exploitation requires only network access to the web application. An attacker sends an HTTP request to the vulnerable page and parses the returned content for the database username and password fields. No credentials, tokens, or user interaction are needed. Attackers commonly locate such pages through directory enumeration, search engine indexing, or reviewing publicly available product documentation.

The vulnerability is described in the TWCERT Security Advisory 11026 and TWCERT Security Advisory 11025.

Detection Methods for CVE-2026-14808

Indicators of Compromise

Unauthenticated HTTP GET requests to configuration or diagnostic pages on the Prog Management System web interface.
Outbound database connections originating from unfamiliar external IP addresses using the application's database service account.
Repeated directory enumeration or scanner traffic targeting the application's URL paths.

Detection Strategies

Review web server access logs for requests to internal pages that return configuration data, particularly requests from external sources without an authenticated session.
Correlate database authentication events with the source IP addresses of connecting clients to identify logins from hosts other than the application server.
Deploy web application firewall rules that block or alert on responses containing patterns resembling database connection strings or credential key-value pairs.

Monitoring Recommendations

Enable database audit logging for successful and failed logins using the application service account, and alert on connections from non-approved hosts.
Monitor for large or unusual query volumes against the Prog Management System database that may indicate mass data extraction.
Track new external scans targeting the application by aggregating web server 200 and 404 response ratios per source IP.

How to Mitigate CVE-2026-14808

Immediate Actions Required

Restrict network access to the Prog Management System web interface by placing it behind a VPN or IP allowlist until a vendor fix is applied.
Rotate the exposed database account password immediately and audit database activity for signs of unauthorized access.
Remove or block access to any configuration, diagnostic, or debug pages that render credentials in HTTP responses.

Patch Information

Refer to the TWCERT Security Advisory 11026 and TWCERT Security Advisory 11025 for vendor remediation guidance. Apply any updates issued by PROG MIS for the Prog Management System as soon as they become available.

Workarounds

Enforce authentication and role-based authorization on all administrative and configuration pages within the application.
Segment the database server on an internal network so it cannot accept connections from arbitrary external hosts.
Replace plaintext credentials in application configuration with values loaded from a secrets manager or environment variables that are not rendered to HTTP responses.

bash

# Example: restrict access to the application at the reverse proxy layer
# nginx configuration snippet
location / {
    allow 10.0.0.0/8;      # internal management network
    deny  all;
    proxy_pass http://prog_mis_backend;
}