Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-14328: Brynamics Online Trade lets remote attackers read database credentials

CVE-2018-14328 · published 8 years ago

Summary

The Brynamics Online Trade web application can be tricked into revealing its database username, password, database name and server IP when someone accesses certain URLs. This exposure could let attackers gain insight into the system and potentially move further. Apply the vendor’s security update or restrict access to those URLs and protect the database with strong passwords.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
brynamics	online_trade	All versions `cpe:2.3:a:brynamics:online_trade:-:::::::*`

Original advisory text

Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensitive information via a direct request for /dashboard/addplan, /dashboard/paywithcard/charge, /dashboard/withdrawal, or /privacy&terms, as demonstrated by reading database username, database password, database_name, and IP address fields, related to CVE-2018-12908.

References

https://cxsecurity.com/issue/WLB-2018070175 Exploit Third Party Advisory
https://www.exploit-db.com/exploits/45094/ Exploit Third Party Advisory VDB Entry

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

11% chance of attack within 30 days

Type

CWE-200Information Exposure

Timeline

Published23 Jul 2018

Updated16 Oct 2026

First seen29 Sep 2026

Sources

CVE-2018-14328 · NVD

Track software like this

Free during beta