Deutsche Telekom Database Dump
Here is a simple and critical vulnerability I’ve found in Deutsche Telekom allowed me to dump the database due to Authorization bypass.
The web application main page is the login page: demandplan.telekom.de/identification.php
index.php, adminuser.php, ProjectExport.php and so on..
I tried to browse every file, all of them redirected to the login page, But that ProjectExport.php file took more seconds and then redirected to the login page.
More seconds with file name includes “export” referred that there is something happened, I opened the file again and I found what I expected, Content-Disposition header response included an attached file -> “export.txt”
This file generated a backup file of the database
By intercepting the response, the generated file content open in the response body, Check the Content-Length header.
That’s enough to get the data but I wanted to get the exact folder name, https://demandplan.telekom.de/$foldername/export.txt
Via a simple manual bruteforce I got it => /export
Final file path was: https://demandplan.telekom.de/export/export.txt
That file included a backup of the database.
Admin login and privileges validation should happen before opening the web page content, Not after, In this web app, the page content opened then validation happened which resulted in redirection to the login page, Just stop the redirection and act like admin.
Telekom only rewards SQLI or RCE reports, But they rewarded this one with 1000 Euro as it’s a very critical one.