Information Disclosure Vulnerability in SourceCodester Simple Online Book Store System

CVE-2025-63891

What is CVE-2025-63891?

The Simple Online Book Store System from SourceCodester contains a vulnerability that exposes sensitive information through a web-accessible backup file. Specifically, an unauthenticated attacker can exploit this flaw by sending an HTTP GET request to the path /obs/database/obs_db.sql. This action allows the attacker to retrieve the entire contents of the database, including its schema and credential hashes, posing a significant risk to the confidentiality of user data and database integrity.

References