website exposes credentials on a registration page

[1]

while trying to register for this site, I found a security hole

it exposes all the environmental variables

https://mysapphireridge.ca/register

Code:

    DB_HOST     "127.0.0.1"
    DB_PORT     "3306"
    DB_DATABASE     "unused"
    DB_USERNAME     ""
    DB_PASSWORD     ""
    REDIS_PORT     "6379"
    MAIL_MAILER     "mailgun"
    MAIL_HOST     "null"
    MAIL_PORT     "587"
    MAIL_USERNAME     "[email protected]"
    MAIL_PASSWORD     "rPRCEd$yW%pEQ3z"
    MAIL_ENCRYPTION "null"
    MAIL_FROM_ADDRESS "[email protected]"
    MAIL_FROM_NAME     "Info"

they are exposing the mail username and password lol

Code:

    MAIL_USERNAME     "[email protected]"
    MAIL_PASSWORD     "rPRCEd$yW%pEQ3z"

someone with zero security experience created this application haha :monkas:

[11]

while trying to register for this site, I found a security hole

it exposes all the environmental variables

https://mysapphireridge.ca/register

Code:

    DB_HOST     "127.0.0.1"
    DB_PORT     "3306"
    DB_DATABASE     "unused"
    DB_USERNAME     ""
    DB_PASSWORD     ""
    REDIS_PORT     "6379"
    MAIL_MAILER     "mailgun"
    MAIL_HOST     "null"
    MAIL_PORT     "587"
    MAIL_USERNAME     "[email protected]"
    MAIL_PASSWORD     "rPRCEd$yW%pEQ3z"
    MAIL_ENCRYPTION "null"
    MAIL_FROM_ADDRESS "[email protected]"
    MAIL_FROM_NAME     "Info"

they are exposing the mail username and password lol

Code:

    MAIL_USERNAME     "[email protected]"
    MAIL_PASSWORD     "rPRCEd$yW%pEQ3z"

someone with zero security experience created this application haha :monkas:

hahahahh mate wtf, what is that page for xd

---

while trying to register for this site, I found a security hole

it exposes all the environmental variables

https://mysapphireridge.ca/register

Code:

    DB_HOST     "127.0.0.1"
    DB_PORT     "3306"
    DB_DATABASE     "unused"
    DB_USERNAME     ""
    DB_PASSWORD     ""
    REDIS_PORT     "6379"
    MAIL_MAILER     "mailgun"
    MAIL_HOST     "null"
    MAIL_PORT     "587"
    MAIL_USERNAME     "[email protected]"
    MAIL_PASSWORD     "rPRCEd$yW%pEQ3z"
    MAIL_ENCRYPTION "null"
    MAIL_FROM_ADDRESS "[email protected]"
    MAIL_FROM_NAME     "Info"

they are exposing the mail username and password lol

Code:

    MAIL_USERNAME     "[email protected]"
    MAIL_PASSWORD     "rPRCEd$yW%pEQ3z"

someone with zero security experience created this application haha :monkas:

hahahahh mate wtf, what is that page for xd

League player, student and anime enjoyer