{"uuid": "f6aa4b74-3404-4c15-ad70-50ead859ac14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-42533", "type": "seen", "source": "https://gist.github.com/7h30th3r0n3/d3063b5d02a41745bc5f2e4b44b272c1", "content": "# CVE-2026-39192 \u2013 Sensitive File Exposure in StandVoice by Conviviance\n\n**Product**: StandVoice  \n**Vendor**: Conviviance  \n**Versions Affected**: 6.2 and before  \n**Vulnerability Type**: Incorrect Access Control (CWE-540, CWE-312, CWE-532, CWE-548)  \n**CVE ID**: CVE-2026-39192  \n**Related**: CVE-2024-42533 (exposed source code reveals all SQLi entry points from that advisory)  \n**Reporter**: 7h30th3r0n3 \u2013 OSINX  \n**CVSS v3.1 Base Score**: 7.5 (High)  \n**Vector**: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`\n\n---\n\n## Description\n\nStandVoice by Conviviance (version 6.2 and before) exposes sensitive files to unauthenticated remote attackers due to Apache misconfiguration. Directory listing is enabled and `.inc` PHP files are served as plaintext on multiple directories, allowing any remote attacker to browse and download all exposed files via simple HTTP GET requests.\n\n**Sensitive data exposed includes:**\n\n- **MySQL credentials** in `/Init/init.inc` (user: `CDBE`, database: `Conviviance`) in cleartext\n- **Google Cloud Platform service account private key** in `/Init/credentials.json` (project: `projet1-dev`), enabling potential access to associated cloud resources\n- **Google Sheets** spreadsheet ID and API integration details\n- **50+ PHP source files** in `/Includes/` with complete application logic (database abstraction layer, authentication logic, Windows Registry access classes, and all business logic)\n- **Log files** in `/Log/` containing complete SQL queries with schema information, user login attempts with credentials in cleartext, session identifiers and internal file paths\n- **log4php configuration** in `/Init/config.xml` confirming TRACE level logging with 100-file retention\n- **Internal Windows file paths** and server configuration details\n\nThe combination of exposed database credentials and source code effectively provides full unauthenticated access to the application backend. This vulnerability is related to CVE-2024-42533 as the exposed source code reveals all SQL injection entry points exploited in that advisory.\n\n---\n\n## Technical Details\n\n**Root Cause:**\n- Apache is configured to serve `.inc` files as `text/plain` instead of interpreting them as PHP.\n- Directory listing (`Options +Indexes`) is enabled on sensitive directories.\n\n**Affected Paths:**\n\n| Path | Content | CWE |\n| --- | --- | --- |\n| `/Init/init.inc` | MySQL server, username, password, database name in cleartext | CWE-540, CWE-312 |\n| `/Init/credentials.json` | Full GCP service account private key | CWE-540 |\n| `/Init/config.xml` | log4php config with TRACE level, 100-file retention | CWE-540 |\n| `/Includes/` | 50+ `.inc` source files (~1 MB total application logic) | CWE-540 |\n| `/Log/` | Rotating log files with SQL queries, credentials, sessions | CWE-532 |\n\n**Attack Vector:**\n- Unauthenticated HTTP GET requests only.\n- No interaction, authentication, or special tools required.\n\n---\n\n## Impact\n\n- **Credential Exposure**: Database credentials and GCP service account key exposed in cleartext.\n- **Source Code Disclosure**: Complete application logic available for analysis, enabling targeted exploitation of further vulnerabilities.\n- **Cloud Resource Compromise**: GCP private key allows potential access to associated cloud project resources.\n- **User Data Leakage**: Log files contain user credentials, session identifiers, and full SQL queries.\n- **Full Reconnaissance**: Exposed source code, configuration, and logs provide complete knowledge of the application architecture.\n\n---\n\n## Timeline\n\n>     June 14, 2024: Discovery of related SQL injection vulnerability (CVE-2024-42533).\n>     June 17, 2024: Initial vulnerability report sent to Conviviance.\n>     June 25, 2024: Conviviance confirms patch available in latest version above 6.x.\n>     2026: Discovery of sensitive file exposure and Apache misconfiguration.\n>     August 26, 2026: CVE-2026-39192 assigned by MITRE.\n\n_Disclosure timestamp: 2026-08-26_\n\n---\n\n## References\n\n- [CVE-2024-42533 \u2013 SQL Injection Advisory](https://gist.github.com/7h30th3r0n3/eae27e0eed39741365c55dfd46b57dc8)\n- [Conviviance](http://conviviance.com)\n- [StandVoice](http://standvoice.com)\n\n---\n\n## Discoverer / Credits\n\nReported by **7h30th3r0n3** \u2013 [OSINX](https://osinx.fr)\n", "creation_timestamp": "2026-08-26T08:09:19.663073Z"}