HackerOne Disclosed Reports - 2025-02-23

Medium
resolved

Information disclosure due to debug mode enabled at Laravel instance https://mpos.mtn.co.sz/

Bug reported by ꦄꦤ꧀ꦢꦿꦶ was disclosed at February 23, 2025, 9:03 am   |   Information Disclosure

The Laravel framework contained a vulnerability known as CVE-2021-3129, which allowed remote code execution due to unsafe usage of PHP in the Ignition debug module. This vulnerability was relatively easy to exploit and did not require user authentication, resulting in a high CVSS score of 9.8. The vulnerability was triggered by sending a crafted POST request to the `/_ignition/execute-solution` endpoint, which allowed an attacker to execute arbitrary code on the target system.