Environment file

The website configuration is available at https://crewplanner.maisonrouge.be/.env .

It contains credentials to a FileMaker database accessible from internet.

Source code disclosure

The .git directory at https://crewplanner.maisonrouge.be/.git/config is unprotected.

The source code for the whole site can be downloaded and credentials extracted.

Resolution

Both .env and .git should be removed and/or hidden by the webserver

FM_DATABASE="maisonrouge"
FM_USERNAME="1MT"
FM_PASSWORD="<redacted>"
FM_HOST="https://database.maisonrouge.be"

Report created by BloodyShell  2021-09-16

Report edited by BloodyShell  2021-09-16

Report approved by BloodyShell  2021-09-16

New PDF report generated by system 2021-09-16

Report dispatched to ...@... by system 2021-09-16

Report dispatched to ...@... by system 2021-09-16

Report marked as fixed by BloodyShell  2021-09-16

Report closed by BloodyShell  2021-09-16

New PDF report generated by system 2021-09-16

Report edited by BloodyShell  2021-09-17

New PDF report generated by system 2021-09-17

Report edited by BloodyShell  2021-10-01

New PDF report generated by system 2021-10-01

Report edited by BloodyShell  2021-10-04

New PDF report generated by system 2021-10-04