Druid credentials hardcoded vulnerability

[NinjaGPT]

Summary

Druid credential is hardcoded, when user uses the default credential or it is leaked, which can lead to allow attacker gather sensitive operation information.

---

Details

• eladmin-system\src\main\resources\config\application-prod.yml

      stat-view-servlet:
        allow:
        enabled: true
        # 控制台管理用户名和密码
        url-pattern: /druid/*
        reset-enable: false
        login-username: admin
        login-password: 123456

---

POC

http://127.0.0.1:8000/druid/login.html

---

Impact

when user uses the default credential or it is leaked, which can lead to allow attacker gather sensitive operation information.

[CFH-Steven]

这是来自QQ邮箱的假期自动回复邮件。   你好，你发的信息我已经收到，谢谢。

[bilisheep]

原来放在配置文件中还算硬编码么，现在ai提交漏洞都不审核了么